You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=clientip
62
+
```
63
+
<!-- Replace code example with this after `sumo://threat/cs` is replaced by `threatlookup`:
59
64
```sql title="Client IP Threat Info"
60
65
_sourceCategory=AWS/WAF {{client_ip}}
61
66
| parse "\"httpMethod\":\"*\"," as httpMethod,"\"httpVersion\":\"*\"," as httpVersion,"\"uri\":\"*\"," as uri, "{\"clientIp\":\"*\",\"country\":\"*\"" as clientIp,country, "\"action\":\"*\"" as action, "\"matchingNonTerminatingRules\":[*]" as matchingNonTerminatingRules, "\"rateBasedRuleList\":[*]" as rateBasedRuleList, "\"ruleGroupList\":[*]" as ruleGroupList, "\"httpSourceId\":\"*\"" as httpSourceId, "\"httpSourceName\":\"*\"" as httpSourceName, "\"terminatingRuleType\":\"*\"" as terminatingRuleType, "\"terminatingRuleId\":\"*\"" as terminatingRuleId, "\"webaclId\":\"*\"" as webaclId nodrop
62
67
| threatlookup singleIndicator clientip
63
68
| where (_threatlookup.type="ipv4-addr:value" or _threatlookup.type="ipv6-addr:value") and !isNull(_threatlookup.confidence)
The Threat Intel Quick Analysis app correlates [threat intelligence](/docs/security/threat-intelligence/) data with your own log data, providing security analytics that helps you to detect threats in your environment, while also protecting against sophisticated and persistent cyber-attacks. The Threat Intel Quick Analysis app scans selected logs for threats based on **IP**, **URL**, **domain, Hash 256,** and **email**.
12
+
The Threat Intel Quick Analysis app correlates [threat intelligence](/docs/security/threat-intelligence/) data with your own log data, providing security analytics that helps you to detect threats in your environment, while also protecting against sophisticated and persistent cyber-attacks. The Threat Intel Quick Analysis app scans selected logs for threats based on IP, URL, domain, SHA-256 hashes, and email.
13
13
14
14
## Log types
15
15
16
-
The Threat Intel Quick Analysis app can be used for any type of logs, regardless of format. Ideal log sources should include **IP**, **URL**, **domain**, **Hash 256**, and/or **email** information.
16
+
The Threat Intel Quick Analysis app can be used for any type of logs, regardless of format. Ideal log sources should include IP, URL, domain, SHA-256 hashes, and/or email information.
17
17
18
18
## Installing the Threat Intel Quick Analysis app
19
19
@@ -27,6 +27,24 @@ import AppInstall from '../../reuse/apps/app-install.md';
27
27
28
28
## Threat Intel optimization
29
29
30
+
The Threat Intel Quick Analysis App provides baseline queries. You can further optimize and enhance these queries for the log and events types being scanned for threats. Use the following guidelines to customize your Threat Intel queries:
31
+
32
+
Filter out unwanted logs before you use lookup operator
| where ip_address != "0.0.0.0" and ip_address != "127.0.0.1"
43
+
| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=ip_address
44
+
```
45
+
46
+
<!-- Replace section content with this after `sumo://threat/cs` is replaced by `threatlookup`:
47
+
30
48
The app provides baseline queries that utilize the [`threatlookup` search operator](/docs/search/search-query-language/search-operators/threatlookup/) to look for threat intelligence data. To see the queries, open a [dashboard in the app](#viewing-threat-intel-quick-analysis-dashboards), click the three-dot kebab in the upper-right corner of the dashboard panel, and select **Open in Log Search**.
31
49
32
50
You can further optimize and enhance these queries for the log and events types being scanned for threats. Use the following guidelines to customize your threat intel queries:
Use [Field Extraction Rules (FER)](/docs/manage/field-extractions/create-field-extraction-rule) to parse fields from your log messages at the time the messages are ingested, which eliminates the need to parse fields at the query level. Use these parsed fields along with Threat Intel Lookup operator.
92
+
Use [Field Extraction Rules (FER)](/docs/manage/field-extractions/create-field-extraction-rule) to parse fields from your log messages at the time the messages are ingested, which eliminates the need to parse fields at the query level. Use these parsed fields along with lookup operator.
74
93
75
94
1. Create the FER For example, for Cylance Security Events, create and use the following Field Extraction Rule:
1. Customize your query so you can use parsed fields from FER with the lookup operator, where src_ip is the parsed field from FER (see step # 1). For example:
99
+
```
100
+
| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=src_ip
101
+
| json field=raw "labels[*].name" as label_name
102
+
| replace(label_name, "\\/","->") as label_name
103
+
| replace(label_name, "\""," ") as label_name
104
+
| where type="ip_address" and !isNull(malicious_confidence)
105
+
| if (isEmpty(actor), "Unassigned", actor) as Actor
106
+
| count as threat_count by src_ip, malicious_confidence, Actor, _source, label_name
107
+
| sort by threat_count
108
+
```
109
+
<!-- Replace the preceding step with the following after `sumo://threat/cs` is replaced by `threatlookup`:
79
110
1. Customize your query so you can use parsed fields from the Field Extraction Rule with the [`threatlookup` search operator](/docs/search/search-query-language/search-operators/threatlookup/), where `src_ip` is the parsed field from the FER. For example:
80
111
```
81
112
| threatlookup singleIndicator src_ip
@@ -85,12 +116,24 @@ Use [Field Extraction Rules (FER)](/docs/manage/field-extractions/create-field-e
85
116
| count as threat_count by src_ip, malicious_confidence, Actor, _source, label_name
86
117
| sort by threat_count
87
118
```
119
+
-->
88
120
89
121
### Scheduled view
90
122
91
123
Use scheduled views with the threat lookup operator to find threats. Scheduled view reduces aggregate data down to the bare minimum, so they contain only the raw results that you need to generate your data. Queries that run against scheduled views return search results much faster because the data is pre-aggregated before the query is run. And a scheduled view query runs continuously, once per minute.
92
124
93
125
1. Create a scheduled view. For example, for Cylance, create a scheduled view, **cylance_threat**:
126
+
```
127
+
_sourceCategory=cylance | lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=src_ip
128
+
| json field=raw "labels[*].name" as label_name
129
+
| replace(label_name, "\\/","->") as label_name
130
+
| replace(label_name, "\""," ") as label_name
131
+
| where type="ip_address" and !isNull(malicious_confidence)
132
+
| if (isEmpty(actor), "Unassigned", actor) as Actor
133
+
| lookup latitude, longitude, country_code, country_name, region, city, postal_code, area_code, metro_code from geo://default on ip = src_ip
134
+
| count as threat_count by src_ip, malicious_confidence, Actor, _source, label_name, city, country_name, raw
135
+
```
136
+
<!-- Replace the preceding code with the following after `sumo://threat/cs` is replaced by `threatlookup`:
94
137
```
95
138
_sourceCategory=cylance
96
139
| threatlookup singleIndicator src_ip
@@ -100,12 +143,15 @@ Use scheduled views with the threat lookup operator to find threats. Scheduled v
100
143
| lookup latitude, longitude, country_code, country_name, region, city, postal_code, area_code, metro_code from geo://default on ip = src_ip
101
144
| count as threat_count by src_ip, malicious_confidence, Actor, _source, label_name, city, country_name, raw
102
145
```
146
+
-->
103
147
1. Now, you can run your Threat Intel query on top of this view:
104
148
```sql
105
149
_view=cylance_threat
106
150
| count by src_ip
107
151
```
108
152
153
+
<!-- Hide this FAQ section until after `sumo://threat/cs` is replaced by `threatlookup`:
154
+
109
155
## Threat Intel FAQ
110
156
111
157
#### What does the Threat Intel Quick Analysis app do?
@@ -131,7 +177,7 @@ No. No results in your dashboards can mean that nothing has been identified as a
131
177
It could be a case-sensitivity issue. In Sumo Logic, the equal sign (`=`) and the not equal to sign (`!=`) conditions are case-sensitive; when you use them with Sumo Logic operators you may need to convert the string to which the condition is applied to upperorlower case. For more information, see [Using toLowerCase or toUpperCase with an equating condition](/docs/search/search-query-language/search-operators/tolowercase-touppercase).
132
178
133
179
#### I already have parsed fields such as IPs, domain, URL, Email, or File Name. Can I use them with this App, instead of parsing each log line again?
134
-
Yes, you can customize the query with in the App. For example:
180
+
Yes, you can customize the query in the app. For example:
135
181
136
182
```
137
183
_sourceCategory= */*/FIREWALL or _sourceCategory=*/*/LB or _sourceCategory=*/*/ROUTER or _sourceCategory=*/*/WINDOWS or _sourceCategory=*/*/SERVER
@@ -179,6 +225,8 @@ Yes, you can run scheduled searches that can be set up with a run frequency of R
179
225
180
226
You can further investigate bad IP triggers by updating your query to check the port as well and see if it is also identified as a malicious port.
181
227
228
+
-->
229
+
182
230
## Viewing Threat Intel Quick Analysis dashboards
183
231
184
232
All dashboards include filters that you can use in Interactive Mode for further analysis of your Threat Intel Quick Analysis data. Because the Threat Intel Quick Analysis has the most bearing on recent threats, most panels are set to the 15 minute time range. You can adjust time ranges as needed.
@@ -259,14 +307,14 @@ See the frequency of URL threats by Actor, Log Source, Malicious Confidence, and
259
307
260
308
### Hash 256
261
309
262
-
See the frequency of Hash 256 threats by Actor, Log Source, Malicious Confidence, and view trends over time.
310
+
See the frequency of SHA-256 threats by Actor, Log Source, Malicious Confidence, and view trends over time.
* **Threat Count.** Count of total Hash 256 threats over the last 15 minutes.
267
-
* **Threats by Malicious Confidence.** Qualifies Hash 256 threats for the last 60 minutes into High, Medium, Low, Unverified, according to Sumo Logic's machine learning engine and displayed as a pie chart.
268
-
* **Threat Breakdown by Sources.** Pie chart of Hash 256 threats over the last 60 minutes broken down by source.
269
-
* **Threats Over Time.** Line chart of the number of Hash 256 threats over the last 60 minutes.
270
-
* **Threat Breakdown by Source.** Line chart of the number of Hash 256 threats over the last 60 minutes, broken down by source.
271
-
* **Threats by Actor.** Identifies Actors, if any, that can be attributed to Hash 256 threats over the last 15 minutes. Actors are identified individuals, groups or nation-states associated to threats.
272
-
* **Threat Table.** Aggregation Table of Hash 256 threats over the last 15 minutes.
314
+
* **Threat Count.** Count of total SHA-256 threats over the last 15 minutes.
315
+
* **Threats by Malicious Confidence.** Qualifies SHA-256 threats for the last 60 minutes into High, Medium, Low, Unverified, according to Sumo Logic's machine learning engine and displayed as a pie chart.
316
+
* **Threat Breakdown by Sources.** Pie chart of SHA-256 threats over the last 60 minutes broken down by source.
317
+
* **Threats Over Time.** Line chart of the number of SHA-256 threats over the last 60 minutes.
318
+
* **Threat Breakdown by Source.** Line chart of the number of SHA-256 threats over the last 60 minutes, broken down by source.
319
+
* **Threats by Actor.** Identifies Actors, if any, that can be attributed to SHA-256 threats over the last 15 minutes. Actors are identified individuals, groups or nation-states associated to threats.
320
+
* **Threat Table.** Aggregation Table of SHA-256 threats over the last 15 minutes.
Copy file name to clipboardExpand all lines: docs/search/search-query-language/search-operators/tolowercase-touppercase.md
+11Lines changed: 11 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -46,6 +46,16 @@ which provides results like:
46
46
47
47
**toLowerCase** and **toUpperCase** are useful when you use the equal to sign (`=`) or the not equal to sign (`!=`) with Sumo operators. These conditions are case-sensitive in Sumo Logic. The following example uses **toLowerCase** to convert the hash value to lower case before performing the lookup.
48
48
49
+
```sql
50
+
*
51
+
| limit1
52
+
| toLowerCase ("B101CD29E18A515753409AE86CE68A4CEDBE0D640D385EB24B9BBB69CF8186AE") as hash
53
+
| count hash
54
+
| fields -_count
55
+
| lookup raw from sumo://threat/cs on threat = hash{code}
56
+
```
57
+
58
+
<!-- Replace code example with this after `sumo://threat/cs` is replaced by `threatlookup`:
Copy file name to clipboardExpand all lines: docs/search/subqueries.md
+13Lines changed: 13 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -378,6 +378,18 @@ _sourceCategory=search "error while retrying to deploy index"
378
378
379
379
The following search allows a security analyst how to track logs related to a malicious IP address that was flagged by Amazon GuardDuty and also by a CrowdStrike Threat feed. The subquery is returning the field `src_ip` with the IP addresses deemed as threats to the parent query, note that the keywords option was not used so the parent query will expect a field src_ip to exist. The results will include logs from the weblogs sourceCategory that have a `src_ip` value that was deemed a threat from the subquery.
380
380
381
+
```sql
382
+
_sourceCategory=weblogs
383
+
[subquery:_sourceCategory="Labs/SecDemo/guardduty""EC2 Instance""communicating on an unusual server port 22"
Copy file name to clipboardExpand all lines: docs/security/additional-security-features/threat-detection-and-investigation.md
+17-1Lines changed: 17 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -284,7 +284,22 @@ We need a way to see if any of the IP addresses we have logged are known threats
284
284
285
285
1. Click **Add Panel** and **Time Series**.<br/><img src={useBaseUrl('img/csa/add-time-series-panel.png')} alt="Add a time series panel" style={{border: '1px solid gray'}} width="300"/>
286
286
1. Type or paste the following code into the query window. (Replace `Labs/AWS/CloudTrail` with a valid source category for AWS CloudTrail logs in your environment.)
287
-
```
287
+
```
288
+
_sourceCategory=Labs/AWS/CloudTrail
289
+
| parse regex "(?<ip_address>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" multi
290
+
| where ip_address != "0.0.0.0" and ip_address != "127.0.0.1"
291
+
| lookup type, actor, raw, threatlevel as malicious_confidence from sumo://threat/cs on threat=ip_address
292
+
| where type="ip_address" and !isNull(malicious_confidence)
293
+
| if (isEmpty(actor), "Unassigned", actor) as Actor
294
+
| parse field=raw "\"ip_address_types\":[\"*\"]" as ip_address_types nodrop
295
+
| parse field=raw "\"kill_chains\":[\"*\"]" as kill_chains nodrop
0 commit comments