Elastic Defend - Is default logging on the endpoint enough?

h49nakxs · November 2, 2023, 1:44pm

Hello,

If I use "Elastic Defend" integration, will all the Elastic Security detection rules get enough information to be triggered or do I need to enhance the logging on the endpoints (for example with Sysmon on Windows and auditd on Linux) ?

My question specifically apply to endpoints using Windows or Linux.

Thanks !

Jonhnathan · November 3, 2023, 2:48pm

Hey @h49nakxs,

Our Detection rules use different data sources, some exclusively use Defend, others Auditbeat or Sysmon, but this must be checked in a per rule basis to evaluate whether or not is beneficial for you (and also possible performance-wise) collect additional data.

Generally, to know which data sources are needed to trigger the rule, you can refer to:

Data Source Tags
- Such as "Data Source: Elastic Endgame", "Data Source: Elastic Defend", "Data Source: Sysmon Only", etc
Related Integrations
- E.g. windows, auditd_manager, elastic defend, etc

We are also working in setup guides that could answer this question in a per rule basis. These can be accessed in the Setup section of the rule details:

h49nakxs · November 14, 2023, 9:27am

Hello,

Thanks a lot for your reply !

Would you say that the data source list is exhaustive for every rule ?

Because this is not the impression I have. For example, the rule :

github.com

elastic/detection-rules/blob/main/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml

[metadata]
creation_date = "2023/10/24"
integration = ["endpoint"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/11/02"

[rule]
author = ["Elastic"]
description = """
Monitors for the deletion of the kernel ring buffer events through dmesg. Attackers may clear kernel ring buffer events
to evade detection after installing a Linux kernel module (LKM).
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Attempt to Clear Kernel Ring Buffer"
risk_score = 21

This file has been truncated. show original

seems pretty feasible with data coming from auditbeat, even if it's not listed in the data source.

Most importantly, what are your criteria to include / exclude data source ? For example, is there a list of fields that are exclusive to one or the other data source ?

system · December 12, 2023, 9:28am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Pre-built set of rules still using SYSMON based detection (winlogbeat- *, event.code: 1, etc.) or using linguistic terms specific to an operating system (eg: Win 10 EN system user is SYSTEM, but Win 10 PT-BR system user is SISTEMA) Endpoint Security	2	656	December 1, 2020
Endpoint Security Intergration vs. Windows and System Intergrations Endpoint Security	3	1093	March 9, 2022
Detection rules for Log4J?s Elastic Security	4	866	January 14, 2022
27 default Elastic Security rules contain definitions to non-existant indices and are broken Elastic Security	5	328	May 24, 2022
Elastic Endpoint Security Data Sources Elastic Security	1	271	February 18, 2022

Elastic Defend - Is default logging on the endpoint enough?

Related topics