DNS Check Malware

Elastic Security SIEM
1

hi all,

how to separate package dns request malware and bitcoin polling in SIEM ?

2

Hi,

How are you receiving these logs? Are you using the Elastic endpoint to collect this data or are relying on an IDS & Proxy implementation?

3

I send packetbeat to elastic and I want to separate the malware domain in SIEM,

can you do it this way?

4

Oh, I see! So, a static lookup against a set of domains that you mention?

Yes, it should be possible. You can create signals for your query and then observe triggers if any. Have a look at the signal to detect IRC activity to the internet.

5

Detection rule alerting SIEM not runing in the elastic subscriptions opensource ?

is there any other way ?

6

Yes! Use the API to query data, in a scheduled manner and then perform alerting through an external API integration.

You could also look at some third-party libraries. Everything including Elastic SIEM has it's limitations. You could decide, what is acceptable and work on it.

7

Thank you I will try to use elastic alerts to do domain detection :grinning:

8

We have found something similar for DHCP here https://zeglory.com/monitoring-dhcp-using-elk/ but would be very interested in getting this for DNS as well. Could you kindly share something describing the solution in details?

9

We have found something similar for DHCP here https://zeglory.com/monitoring-dhcp-using-elk/ but would be very interested in getting this for DNS as well. Could you kindly share something describing the solution in details?

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.