Aggregation in SO Playbooks

[spvcxsh1p]

Hello!
I am using Security Onion version 2.3.260.

I need to create a Playbook using event aggregation. Below is an example of a SIGMA rule for such a Playbook:

title: Network Scans
id: fab0ddf0-b8a9-4d70-91ce-a20547209afb
description: Detects many failed connection attempts to different ports or hosts
author: Thomas Patzke
date: 2017/02/19
logsource:
category: firewall
detection:
selection:
action: denied
timeframe: 24h
condition:
- selection | count(dst_port) by src_ip > 10
- selection | count(dst_ip) by src_ip > 10
fields:
- src_ip
- dst_ip
- dst_port
falsepositives:
- Inventarization systems
- Vulnerability scans
- Penetration testing activity
level: medium

However, in the Playbook module, under "Create New Play," when attempting to convert this Sigma rule into an SO Elasticsearch Query, I receive the following response:

"An unsupported feature is required for this Sigma rule (/tmp/tmpwln7xqw6): Aggregations not implemented for this backend
Feel free to contribute for fun and fame, this is open source :) -> https://github.com/Neo23x0/sigma "

As far as I understand, the ElastAlert module, which the SIGMA rule is supposed to convert into, does not support aggregation.
Correlation functions in SIGMA rules also appear to be unsupported in ElastAlert, as far as I can tell.

Could you please confirm if my understanding is correct? Also, is there any other way I can implement similar rule logic in SO version 2.3.260?

[InfosecGoon]

Sigma is a vendor-agnostic metalanguage designed to work on a number of different backends, not just Elasticsearch. The correlation feature that this rule uses may be supported elsewhere, but it is not supported in Elasticsearch.

Also, just so you know, the 2.3.x versions of Security Onion are EOL and are no longer being supported or updated.

[spvcxsh1p]

Hello!
I understand that the SO I use is outdated, but unfortunately, this is not my responsibility.
Are there any other options to implement the logic I described in the rule on this version of SO? Maybe it is possible to do something similar by directly writing a rule for ElastAlert?

[InfosecGoon]

Not that I'm aware of. This sort of correlation is not supported in Elasticsearch queries.

[9lceHb]

Thomas Patzke
Hi, I found that Suricata or Sigma rules in SO are really bad at handling aggregations. However elasticsearch queries can solve this type of problem. Here is an example for elasticsearch query based on SO that might help you, make sure you use field names that match your logs and use appropriate filters.

sudo so-elasticsearch-query '*/_search' -d '{ "_source": false, "query": { "bool": { "must": { "range": { "@timestamp": { "gte": "now-6m", "lt": "now-5m" } } } } }, "aggs": { "group_by_source_ip": { "terms": { "field": "source.ip", "size": 1000000 }, "aggs": { "unique_destination_ips": { "cardinality": { "field": "destination.ip" } }, "filter_high_count": { "bucket_selector": { "buckets_path": { "count": "unique_destination_ips" }, "script": "params.count > 30" } }, "formatted_result": { "bucket_script": { "buckets_path": { "doc_count": "_count", "unique_ips": "unique_destination_ips" }, "script": "params.unique_ips" } } } } } }' | jq '.aggregations.group_by_source_ip.buckets | map({source_ip: .key, doc_count: .doc_count, unique_destination_ips: .unique_destination_ips.value})'