How to create a complex detection rule (indicator + correlation)?

Elastic Security
1

For example, i have list with malware domains.
I save logs from my DNS servers.
I want to create alert when any client of my network has request for malware domain name.
And with this, i need to aggregate this requests - for example the client had made 50 requests and ELK creates only 1 alert.
Is it possible to create such detection rule?

1 Like
2

Hey there :wave:

You should be able to take advantage of marking rules as building block to achieve what you want.

  • Create an indicator match rule which matches domain lookups from your DNS logs against your malware domains list and mark it as building block (this will generate the alert document in the alerts index, but not create an alert in the table)
  • create a threshold rule looking at your alerts index, with the query of event.kind:signal and kibana.alert.rule.rule_id:<rule-id-of-indicator-match-rule> and group by the domain field >= 50

This should generate one alert for you for every 50 matches against a known bad domain.

3 Likes
3

Can use this "building block" on 7.15.2 version?

4

And btw, if i have too different PC and they try to connect to malware website for example - can this mark (building block) aggregate they separately?
I mean - i want to see as result two alerts (1 for the first PC and 1 for the second)

5

Yep, building block has been available from very early on.

To create an alert for each individual host, in addition to adding your domain field to group by, you can also add the host, with host.id or any other host-specific UUID. Group by allows multiple fields (as of 7.12 IINM)

6

How can i check the alert indices for building blocks really was created?
Can you give example query?

8

I had create a test rules:
one for building blocks and one for alert creation
The rule for alert creation use goup by user.name and count for client.ip (all uniqs).
So it looks like work but in alerts i don't see fields client.ip and geo information (i see all this information in building blocks).

9

I cant' group alerts with client.ip.keyword field (btw i can use only *.keyword fields there) because system index template .siem-signals-default have map client.ip as ip. So i got error that client.ip must be object not ip and i can't edit that mapping cause that is system index template.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.