Solved! Go to Solution.
Certainly makes sense and I would expect it to work. Can you try breaking it down and see if it's a single element causing an issue?
E.g. create the same rule but use fixed values instead of the watchlist and send/replay through a sample that should trigger it.
This would indicate if the problem is getting the watchlists onto the receiver performing the alarm or if it's a problem with the overall rule structure.
(Reformatted for readability)
I created three Watchlists and tied them to a Field Match in and Alarm, but it is not firing.
1. Account - Critical Source User > Source User: List of root and admin users
2. Assets - Network Systems > Host: List of network Hostnames
3. Suspicious User Activity > Signature ID: List of Signature ID's for failed logins
For my Field Match:
| Filters -> Source User (In) [Accounts - Critical Source User]
- : AND | Filters -> Host (In) [Assets - Network Systems]
| Filters -> Signature ID (In) [Suspicious user activity]
Maximum Condition Trigger Frequency 5 Minutes
I can run a query with those watchlists as filters and see that the events are there.
Does the AND statement say:
IF one of the Source Users in the [Accounts - Critical Source User] Watchlist are present AND
IF one of the Hosts in the [Assets - Network Systems] Watchlist are present AND
IF one of the Signature ID's in the [Suspicious user activity] Watchlist are present
THEN fire off the Alarm?
Thanks for your help.
Certainly makes sense and I would expect it to work. Can you try breaking it down and see if it's a single element causing an issue?
E.g. create the same rule but use fixed values instead of the watchlist and send/replay through a sample that should trigger it.
This would indicate if the problem is getting the watchlists onto the receiver performing the alarm or if it's a problem with the overall rule structure.
Thanks. This help me troubleshoot the issue and I found that if I included both the hostname and the fqdn hostname in the watchlist it would work.
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA