Elastic Defend - Is default logging on the endpoint enough?

h49nakxs · November 2, 2023, 1:44pm

Hello,

If I use "Elastic Defend" integration, will all the Elastic Security detection rules get enough information to be triggered or do I need to enhance the logging on the endpoints (for example with Sysmon on Windows and auditd on Linux) ?

My question specifically apply to endpoints using Windows or Linux.

Thanks !

Jonhnathan · November 3, 2023, 2:48pm

Hey @h49nakxs,

Our Detection rules use different data sources, some exclusively use Defend, others Auditbeat or Sysmon, but this must be checked in a per rule basis to evaluate whether or not is beneficial for you (and also possible performance-wise) collect additional data.

Generally, to know which data sources are needed to trigger the rule, you can refer to:

Data Source Tags
- Such as "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon Only", etc
Related Integrations
- E.g. windows, auditd_manager, elastic defend, etc

We are also working in setup guides that could answer this question in a per rule basis. These can be accessed in the Setup section of the rule details:

h49nakxs · November 14, 2023, 9:27am

Hello,

Thanks a lot for your reply !

Would you say that the data source list is exhaustive for every rule ?

Because this is not the impression I have. For example, the rule :

github.com

elastic/detection-rules/blob/main/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml

[metadata]
creation_date = "2023/10/24"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/11/02"

[rule]
author = ["Elastic"]
description = """
Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events
to evade detection after installing a Linux kernel module (LKM).
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Attempt to Clear Kernel Ring Buffer"
risk_score = 21

This file has been truncated. show original

seems pretty feasible with data coming from auditbeat, even if it's not listed in the data source.

Most importantly, what are your criteria to include / exclude data source ? For example, is there a list of fields that are exclusive to one or the other data source ?

system · December 12, 2023, 9:28am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.