[Rule Tuning] Linux DR Tuning - 3 #5483
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Aegrah
added
OS: Linux
Rule: Tuning
Contributor
Rule: Tuning - GuidelinesThese guidelines serve as a reminder set of considerations when tuning an existing rule. Documentation and Context
Rule Metadata Checks
Testing and Validation
|
|
⛔️ Test failed Results
|
Mikaayenson
approved these changes
Dec 17, 2025
rules/linux/credential_access_aws_creds_search_inside_container.toml
Outdated
Show resolved
Hide resolved
eric-forte-elastic
approved these changes
Dec 18, 2025
Contributor
eric-forte-elastic
left a comment
eric-forte-elastic
left a comment
There was a problem hiding this comment.
🟢 Manual review, looks good to me! 👍
Samirbous
reviewed
Dec 18, 2025
Comment on lines
74
to
75
| Esql.agent_id_values = values(agent.id), | ||
| Esql.event_dataset_values = values(event.dataset), |
Contributor
There was a problem hiding this comment.
those 2 are already defined : agent.id is in the aggregation and dataset is in the query index logs-endpoint.events.process*
| ) | ||
| ] with runs=10 | ||
| from logs-endpoint.events.process* metadata _id, _index, _version | ||
| | mv_expand event.action |
Contributor
There was a problem hiding this comment.
you will need to add | eval time_window = DATE_TRUNC(1 minute, @timestamp) or 30s to have similar behavior as maxspan with the adequate threshold, but from telm it seems like the rule is not very noisy, instead of converting it to ESQL just add a condition on process.args_count <= 2
Contributor
Author
There was a problem hiding this comment.
Added the eval with 1 minute.
Samirbous
reviewed
Dec 18, 2025
| by process.parent.executable, agent.id, user.id | ||
| | where Esql.event_count >= 25 |
Contributor
There was a problem hiding this comment.
too high compared to if you just dropped args_count <= 2
Contributor
Author
There was a problem hiding this comment.
This is way more efficient, and a brute force will very likely exceed this number. However, I bumped it down to the original >= 10 as the rule was doing fine; this is just a performance increase.
Samirbous
reviewed
Dec 18, 2025
| "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", | ||
| "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", | ||
| "::1", "FE80::/10", "FF00::/8") ] with runs = 10 | ||
| from "filebeat-*", "logs-system.auth-*" metadata _id, _index, _version |
Contributor
There was a problem hiding this comment.
it may error because of the multi-index (if one is missing), you will also need to add the | eval time_window = DATE_TRUNC(30 seconds, @timestamp) and set the Esql.event_count >= 60 to reduce noise (try it on telm and you will see with 25 it will remain noisy)
Contributor
Author
There was a problem hiding this comment.
Bumped to 60.
it may error because of the multi-index (if one is missing)
That's a good call, though. Because of this reason, we probably shouldn't even convert to ESQL. Will discuss this via Slack.
| Esql.event_dataset_values = values(event.dataset), | ||
| Esql.data_stream_namespace_values = values(data_stream.namespace) | ||
| by source.ip, agent.id, user.name |
Contributor
There was a problem hiding this comment.
should by source.ip, agent.id to be similar to the previous logic, by user.name will miss attempt to brute-force multi accounts using same pwd.
Contributor
Author
There was a problem hiding this comment.
Discussed this on Slack, will create a new rule for password spraying and keep this one as we had it previously (on source.ip, agent.id and user.name)
rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml
Show resolved
Hide resolved
Samirbous
reviewed
Dec 18, 2025
rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml
Show resolved
Hide resolved
Samirbous
reviewed
Dec 18, 2025
| [authentication where host.os.type == "linux" and event.action in ("ssh_login", "user_login") and | ||
| event.outcome == "failure" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ] with runs=10 | ||
| event.outcome == "failure" and source.ip != null and source.ip != "0.0.0.0" and source.ip != "::" ] with runs=25 |
Contributor
There was a problem hiding this comment.
have u tried to use ES|QL on the telem rule to see if 25 will reduce noise or not ?
Contributor
Author
There was a problem hiding this comment.
I don't think we can write an ESQL rule on a sequence from failed --> success? We can write one to say failure X and success Y, but no sequencing, which makes it not really a way to detect the succesful piece of the brute force attack.
Samirbous
reviewed
Dec 18, 2025
Aegrah
commented
Dec 18, 2025
rules/linux/credential_access_aws_creds_search_inside_container.toml
Outdated
Show resolved
Hide resolved
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
Removed 'auditbeat-*' from the index list.
|
⛔️ Test failed Results
|
Removed redundant event.action expansion and filtering logic.
|
⛔️ Test failed Results
|
Refactor ESQL query to improve readability and maintainability by moving the event.action expansion and filtering logic.
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
|
⛔️ Test failed Results
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request Summary
Why
This PR updates and enhances several Linux credential access detection rules, with a focus on improving detection accuracy, expanding data source coverage, increasing risk prioritization, and deprecating certain rules.
What changed
General Enhancements
auditd_managerandsentinel_one_cloud_funnel.logs-auditd_manager.auditd-*,logs-sentinel_one_cloud_funnel.*,endgame-*,auditbeat-*).host.idtoagent.id).Rule-Specific Notes
cat,sed, andawk.auditd_managerandsentinel_one_cloud_funnel.agent.id.auditd_managerintegration and index.endgame-*to index.auditd_managerintegration and index.intervaland new ESQL query logic for more robust brute force detection.intervaland new ESQL query logic for more robust brute force detection.Behavioral impact
Risks/edge cases
Rollout notes