How to show alerts from not default sources

[ByteAndBits]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

128

RAM

1TB

Storage for /

30TB

Storage for /nsm

60TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Is it possible to show not default warings in alerts (no suricata, windows logs).

we want to get an alert if anybody has a wrong login to the firewall. For this we created some datafilds:
event.provider: auth, auth.satus: failed

If this happens we need an alert.

I think via playbook it is not possible. But how can we show warnings like that in the alerts section of SecOnion

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[petiepooo]

Have you read through this section?
https://docs.securityonion.net/en/2.3/soc-customization.html#custom-queries

This is one of the settings that still require copying a default file to the local tree and modifying it manually.

[InfosecGoon]

You would need to write that alert in Playbook using Sigma.

Can you provide a sample of the event you want to alert on so we can see all of the field names and values? Stuff like IPs and usernames can be redacted if necessary.

[ByteAndBits]

data_stream.dataset: firewall.syslog
event.provider: auth
auth.status: failed

if this three things happens we need the alert

[InfosecGoon]

Create a new Play in Playbook with this Sigma in it, then make it active.

title: Firewall Login Failure
status: experimental
description: Detects when there are bad logins to the firewall.
author: InfosecGoon
logsource:
    product: firewall
    service: syslog
detection:
    selection:
        data_stream.dataset: firewall.syslog
        event.provider: auth
        auth.status: failed
    condition: selection
level: high

[ByteAndBits]

Works perfect. Thank´s a lot.