EQL - Alert on different values for the same field in a sequence

Elastic Security
1

Hi,

I am trying to build a sequence, as an example to look for multiple different user.names from the same host over a period of time. How would i go about this condition 2 user.name != condition 1 user.name. There a number of scenarios this would be useful for, i have looked through the documentation but cannot find what i am looking for.

    sequence by source.ip with maxspan=30s
      [ authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" ]
      [ authentication where event.action:"logon-failed" and source.ip != "127.0.0.1" ]

Thanks
Phil

2

hi @probson, glad to see you're using EQL.

With the EQL as of 7.10, there's no way to do the != check, but you can use by for the == check. What you're looking for will depend on the filter pipe, which is not yet implemented in Elasticsearch.

If you want to see some examples of how the filter pipe works for Elastic Endgame, here is its documentation.

3

@rw-access

That looks good so in theory we should be able to do the below when the filter pipe is released?

| filter events[0].user.name != events[1].user.name

4

looks like unique_count is what i would be really looking at, hopefully that will be implemented as well.

Thanks

5

@rw-access

Hi there, any update on when we might see the more advanced EQL pipes such as filter and unique_count?

6

Hi @probson,

I think at this point, it's best to treat Endgame EQL as separate, and not a roadmap for Elasticsearch EQL.

We are exploring options to see if there's a better way to address this use case within our outside of EQL.

One feature that's under development is adding a concept of cardinality to threshold rules within the detection engine. Within that you'll be able to say this:

  • Group by source.ip
  • Limit to groups with at least 2 documents
  • Make sure there are at least 2 unique values for user.name

I think when that functionality is available, it'll be the best way to solve your current use case.

7

@rw-access

Cardinality would be very nice to have, i used it with ElastAlert in the past. At the moment ive been trying to look at using ML and the high_distinct_count to do something similar.