31. Logs: detection rules, alerts, Sigma, entities and ATT&CK

Detection rules are standing questions over the collected logs. When a rule's condition is met, it raises an alert. Alerts are triaged through their review-queue items, in the same way as any other finding. Sigma installs community rules translated to Lawliet's query language. Entities ranks users, hosts and addresses by the alerts that name them. ATT&CK shows which techniques the rules cover.

Permissions:

31.1 The Rules tab#

Path: Logs > Rules. "Standing rules over the collected logs: thresholds, sequences, baselines, pipelines and Sigma."

• Filters: Name, query, technique or tag, Every kind, origin (Custom and Sigma, Custom, Sigma), Any health.
• Columns: Rule, Kind, Health, ATT&CK, Origin, Version, Fired, Last run, Actions.
• Actions: Enable / Disable, run now ("Evaluate now, for real"), Version history, Delete.

A rule whose Health shows an error cannot run and raises nothing. Open it and fix it.

Rule kinds#

31.2 Procedure: create a detection rule#

Permission: Manage detection rules. Four-eyes: no.

Risk: a noisy rule floods the review queue; a rule that never fires gives false comfort. Always preview before enabling. Rollback: disable the rule, or restore an earlier version.

1. Open Logs > Rules and press New rule (or Make this a rule from a search).
2. On the Definition tab fill:

3. Open the Preview and test tab.
4. Under Preview against real history press Preview. "Reads only. No alerts are raised and nothing is saved." Read how many events matched and how many alerts the rule would have raised. "Nothing reached the line" means it would not have fired: maybe right, maybe too strict.
5. Optional: Test on sample lines - paste raw lines (syslog, JSON, CEF, Windows XML), oldest first, and see which match and how they were parsed.
6. Press Create rule (for an existing rule: Save as new version).
7. When the preview looks right, press Enable on the rule row.

What you see: the rule in the table with its version. Enabled rules are evaluated on the next cycle.

To check a rule at once: press the run button ("Evaluate now, for real"). The notice says "<rule> evaluated N group(s) and raised M alert(s)" or "<rule> could not be evaluated: <error>". This is a real run: alerts it raises are real.

Procedure: change a rule#

Permission: Manage detection rules. Four-eyes: no. Rollback: restore the previous version (below).

1. Open Logs > Rules and click the rule's name. The editor opens with the current definition.
2. Change the fields on Definition; check the effect on Preview and test (31.2 steps 3-5).
3. Press Save as new version. The Version column goes up by one.

Procedure: enable, disable or run a rule now#

1. Open Logs > Rules.
2. Press Enable ("Start evaluating this rule") or Disable ("Stop evaluating this rule") on the row. The notice says "<rule> enabled (version N)." or "<rule> disabled (version N)."; each change is saved as a new version.
3. To evaluate it at once, press the play button (Run <rule> now, "Evaluate now, for real"). Alerts it raises are real.

Procedure: restore an earlier version#

Every save is a new version. "History is never rewritten: restoring saves the current definition as a version first."

1. On the rule's row press the clock button (History of <rule>, "Version history").
2. The panel "History: <rule>" shows "Current version N" and a button per older version (vN). Press one to see what differs (Field, vN, Current).
3. Press Restore vN as a new version.
4. What you see: "Version N of <rule> restored as version M." If it fails: "That version could not be restored."

"This rule has never been edited" means there is only one version.

Procedure: delete a rule#

Risk: deleting a rule deletes its version history and, if it has raised alerts, those alerts and their review-queue links. Rollback: none. Prefer Disable, which stops the rule and keeps everything.

1. On the rule's row press the bin (Delete <rule>).
2. The browser asks "Delete the rule <rule>? Its version history goes with it." Press OK.
3. If the rule has raised alerts, a second question follows: "<rule> has raised alerts. Deleting it deletes that history too, including anything linked from the review queue. Disable it instead to stop it running. Delete the history as well?" Press OK only if that history must go; Cancel keeps the rule.
4. What you see: the row disappears. If it fails: "<rule> could not be deleted."

31.3 The Alerts tab#

Path: Logs > Alerts. "What the detection rules raised, triaged through the review queue."

• Filters: time range, Any status, Any severity, Every rule, User, host or address + Filter.
• Columns: Severity, Alert, Entities, ATT&CK, Status, Assignee, Raised.

Procedure: triage alerts in bulk#

1. Tick alerts (or Select all).
2. In the bar that appears, choose the new status, type a Comment ("kept on each review item") and press Set status; or choose a person in Assign selected (or Nobody (unassign)).

Procedure: escalate alerts to an investigation#

Permission: Run forensics.

1. Tick the alerts.
2. Under Investigation choose an open case or A new investigation; give a Name ("Named after the first alert if empty") and a Priority.
3. Press Escalate. The alerts are linked to the case (chapter 34).

Procedure: work one alert#

Permissions: Work the review queue to triage; Manage detection rules to suppress; Run forensics to escalate. Four-eyes: no.

1. Open Logs > Alerts and click the alert. The drawer shows Window, Matches and Review item.
2. To triage it: under Triage choose the Status, type a Comment and press Save; choose a person in Assign alert to assign it. ("This alert has no review item" means there is nothing to triage.)
3. To silence an expected subject: under Suppress this subject choose Suppress for (4 hours, 1 day, 3 days, 7 days, 30 days), type the Reason, tick every rule to cover all rules, and press Suppress. Alerts for that subject stop until the suppression ends. If the rule is not grouped there is no subject; add an Exception to the rule instead.
4. To open a case from it: press Escalate, choose the case or A new investigation, and press To an investigation.
5. To see the context: read Evidence (the events behind the alert) and press Search around it to open the Search tab at that time.

A suppression cannot be listed or ended early in the console in this release; it lapses at the end of the period you chose. Choose the shortest period that covers the expected activity. Alerts are never deleted by hand; they are closed through their review item and removed only with their rule (above) or by retention.

31.4 The Sigma tab#

Path: Logs > Sigma. Two views: Rule pack and Paste YAML.

Procedure: install rules from the pack#

1. Open Logs > Sigma (Rule pack).
2. Search (Title, technique, description or path) and filter by product and state (Not installed, Installed, Cannot be translated).
3. Click a rule to see what it Translates to, what it is grouped by, and any Translation notes. Rules marked "not translatable" cannot be installed.
4. Tick the rules to install. Leave Enable on install off.
5. Press Install selected.

What you see: "Installed N rules; skipped M." With Enable on install off they are "Installed disabled: preview each one against this estate's traffic on the Rules page, then enable it." Do that (31.2 steps 3-7).

Procedure: import your own Sigma YAML#

1. Open Paste YAML and paste one or more documents (separate them with ---).
2. Press Translate. It writes nothing; it shows what each rule becomes and what could not be carried over.
3. Press Import N.

31.5 The Entities tab#

Path: Logs > Entities. "Users, hosts and addresses ranked by the alerts that name them."

• Type buttons: All, Users, Hosts, Source IPs, Destination IPs; Find; a minimum score.
• Columns: Entity, Type, Risk, Alerts, Tactics, Top factors, Last alert.
• Recompute (Manage detection rules) rescores every entity from the alerts so far.

To rescore after changing rules or closing many alerts:

1. Open Logs > Entities and press Recompute.
2. The list reloads with the new scores. Use the type buttons, the search box and Find to narrow it; click an entity for Why this score; Back to entities returns to the list.

Click an entity for Why this score (Alert, Rule, Severity, Age, Points), Alerts naming it, and Recent events for a chosen window.

31.6 The ATT&CK tab#

Path: Logs > ATT&CK. "Which techniques the enabled detection rules watch, and which of them fired."

• Alerts: last 7 / 30 / 90 / 365 days and Only techniques with rules.
• Legend: Covered and fired, Covered by an enabled rule, Only disabled rules, No rule.
• Select a technique for its detail: Rules for <technique> opens the Rules tab filtered to it; Find a Sigma rule opens the Sigma tab to look for one.

31.7 If it fails#