Alarm with Watchlists not firing

[User20705984]

I created three Watchlists and tied them to a Field Match in and Alarm, but it is not firing. 1. Account - Critical Source User > Source User: List of root and admin users 2. Assets - Network Systems > Host: List of network Hostnames 3. Suspicious User Activity > Signature ID: List of Signature ID's for failed logins For my Field Match: | Filters -> Source User (In) [Accounts - Critical Source User] - : AND | Filters -> Host (In) [Assets - Network Systems] | Filters -> Signature ID (In) [Suspicious user activity] Maximum Condition Trigger Frequency 5 Minutes I can run a query with those watchlists as filters and see that the events are there. Does the AND statement say: If one of the Source Users in the [Accounts - Critical Source User] Watchlist are present AND If one of the Hosts in the [Assets - Network Systems] Watchlist are present AND If one of the Signature ID's in the [Suspicious user activity] Watchlist are present then fire off the Alarm? Thanks for your help.

[User20705984]

(Reformatted for readability)

I created three Watchlists and tied them to a Field Match in and Alarm, but it is not firing.

1. Account - Critical Source User > Source User: List of root and admin users
2. Assets - Network Systems > Host: List of network Hostnames
3. Suspicious User Activity > Signature ID: List of Signature ID's for failed logins

For my Field Match:

             | Filters -> Source User (In) [Accounts - Critical Source User]
- : AND | Filters -> Host (In) [Assets - Network Systems]
             | Filters -> Signature ID (In) [Suspicious user activity]

Maximum Condition Trigger Frequency 5 Minutes

I can run a query with those watchlists as filters and see that the events are there.
Does the AND statement say:

IF one of the Source Users in the [Accounts - Critical Source User] Watchlist are present AND
IF one of the Hosts in the [Assets - Network Systems] Watchlist are present AND
IF one of the Signature ID's in the [Suspicious user activity] Watchlist are present
THEN fire off the Alarm?

Thanks for your help.

[lratcliffe · Accepted solution]

Certainly makes sense and I would expect it to work.  Can you try breaking it down and see if it's a single element causing an issue?

E.g. create the same rule but use fixed values instead of the watchlist and send/replay through a sample that should trigger it.

This would indicate if the problem is getting the watchlists onto the receiver performing the alarm or if it's a problem with the overall rule structure.

[User20705984]

Thanks. This help me troubleshoot the issue and I found that if I included both the hostname and the fqdn hostname in the watchlist it would work.