cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Alarm with Watchlists not firing

Jump to solution
I created three Watchlists and tied them to a Field Match in and Alarm, but it is not firing. 1. Account - Critical Source User > Source User: List of root and admin users 2. Assets - Network Systems > Host: List of network Hostnames 3. Suspicious User Activity > Signature ID: List of Signature ID's for failed logins For my Field Match: | Filters -> Source User (In) [Accounts - Critical Source User] - : AND | Filters -> Host (In) [Assets - Network Systems] | Filters -> Signature ID (In) [Suspicious user activity] Maximum Condition Trigger Frequency 5 Minutes I can run a query with those watchlists as filters and see that the events are there. Does the AND statement say: If one of the Source Users in the [Accounts - Critical Source User] Watchlist are present AND If one of the Hosts in the [Assets - Network Systems] Watchlist are present AND If one of the Signature ID's in the [Suspicious user activity] Watchlist are present then fire off the Alarm? Thanks for your help.
1 Solution

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 4

Re: Alarm with Watchlists not firing

Jump to solution

Certainly makes sense and I would expect it to work.  Can you try breaking it down and see if it's a single element causing an issue?

E.g. create the same rule but use fixed values instead of the watchlist and send/replay through a sample that should trigger it.

This would indicate if the problem is getting the watchlists onto the receiver performing the alarm or if it's a problem with the overall rule structure.

View solution in original post

3 Replies
Highlighted

Re: Alarm with Watchlists not firing

Jump to solution

(Reformatted for readability)

I created three Watchlists and tied them to a Field Match in and Alarm, but it is not firing.

1. Account - Critical Source User > Source User: List of root and admin users
2. Assets - Network Systems > Host: List of network Hostnames
3. Suspicious User Activity > Signature ID: List of Signature ID's for failed logins

For my Field Match:

             | Filters -> Source User (In) [Accounts - Critical Source User]
- : AND | Filters -> Host (In) [Assets - Network Systems]
             | Filters -> Signature ID (In) [Suspicious user activity]

Maximum Condition Trigger Frequency 5 Minutes

I can run a query with those watchlists as filters and see that the events are there.
Does the AND statement say:

IF one of the Source Users in the [Accounts - Critical Source User] Watchlist are present AND
IF one of the Hosts in the [Assets - Network Systems] Watchlist are present AND
IF one of the Signature ID's in the [Suspicious user activity] Watchlist are present
THEN fire off the Alarm?

Thanks for your help.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 4

Re: Alarm with Watchlists not firing

Jump to solution

Certainly makes sense and I would expect it to work.  Can you try breaking it down and see if it's a single element causing an issue?

E.g. create the same rule but use fixed values instead of the watchlist and send/replay through a sample that should trigger it.

This would indicate if the problem is getting the watchlists onto the receiver performing the alarm or if it's a problem with the overall rule structure.

View solution in original post

Re: Alarm with Watchlists not firing

Jump to solution

Thanks. This help me troubleshoot the issue and I found that if I included both the hostname and the fqdn hostname in the watchlist it would work.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community