|
| 1 | +[metadata] |
| 2 | +creation_date = "2025/11/18" |
| 3 | +integration = ["endpoint", "panw", "fortinet_fortigate", "suricata"] |
| 4 | +maturity = "production" |
| 5 | +updated_date = "2025/11/18" |
| 6 | + |
| 7 | +[rule] |
| 8 | +author = ["Elastic"] |
| 9 | +description = """ |
| 10 | +This rule correlate any Elastic Defend alert with a set of suspicious events from Network security devices like Palo Alto |
| 11 | +Networks (PANW) and Fortinet Fortigate by host.ip and source.ip. This may indicate that this host is compromised and |
| 12 | +triggering multi-datasource alerts. |
| 13 | +""" |
| 14 | +from = "now-60m" |
| 15 | +interval = "10m" |
| 16 | +language = "esql" |
| 17 | +license = "Elastic License v2" |
| 18 | +name = "Elastic Defend and Network Security Alerts Correlation" |
| 19 | +risk_score = 73 |
| 20 | +rule_id = "0bca7e73-e1b5-4fb2-801b-9b5f5be20dfe" |
| 21 | +severity = "high" |
| 22 | +tags = [ |
| 23 | + "Use Case: Threat Detection", |
| 24 | + "Rule Type: Higher-Order Rule", |
| 25 | + "Resources: Investigation Guide", |
| 26 | + "Data Source: Elastic Defend", |
| 27 | + "Data Source: Fortinet", |
| 28 | + "Data Source: PAN-OS" |
| 29 | +] |
| 30 | +timestamp_override = "event.ingested" |
| 31 | +type = "esql" |
| 32 | + |
| 33 | +query = ''' |
| 34 | +FROM logs-* metadata _id |
| 35 | +| WHERE |
| 36 | + // Elastic Defend Alerts |
| 37 | + (event.module == "endpoint" and event.dataset == "endpoint.alerts") or |
| 38 | +
|
| 39 | + // PANW suspicious events |
| 40 | + (event.dataset == "panw.panos" and |
| 41 | + event.action in ("virus_detected", "wildfire_virus_detected", "c2_communication", "spyware_detected", "large_upload", "denied", "exploit_detected")) or |
| 42 | +
|
| 43 | + // Fortigate suspicious events |
| 44 | + (event.dataset == "fortinet_fortigate.log" and |
| 45 | + (event.action in ("outbreak-prevention", "deny", "infected", "blocked") or message like "backdoor*" or message like "Proxy*" or message like "anomaly*" or message like "P2P*" or message like "misc*" or message like "DNS.Over.HTTPS" or message like "Remote.Access")) or |
| 46 | +
|
| 47 | + // Suricata |
| 48 | + (event.dataset == "suricata.eve" and message in ("Command and Control Traffic", "Potentially Bad Traffic", "A Network Trojan was detected", "Detection of a Network Scan", "Domain Observed Used for C2 Detected", "Malware Command and Control Activity Detected")) |
| 49 | +
|
| 50 | +// extract source.ip from PANW or Fortigate events and host.ip from Elastic Defend alert |
| 51 | +|eval fw_alert_source_ip = CASE(event.dataset in ("panw.panos", "fortinet_fortigate.log"), source.ip, null), |
| 52 | + elastic_defend_alert_host_ip = CASE(event.module == "endpoint" and event.dataset == "endpoint.alerts", host.ip, null) |
| 53 | +| eval Esql.source_ip = COALESCE(fw_alert_source_ip, elastic_defend_alert_host_ip) |
| 54 | +| where Esql.source_ip is not null |
| 55 | +
|
| 56 | +// group by host_source_ip shared between FG/PANW and Elastic Defend |
| 57 | +| stats Esql.alerts_count = COUNT(*), |
| 58 | + Esql.event_module_distinct_count = COUNT_DISTINCT(event.module), |
| 59 | + Esql.event_module_values = VALUES(event.module), |
| 60 | + Esql.message_values = VALUES(message), |
| 61 | + Esql.event_action_values = VALUES(event.action), |
| 62 | + Esql.process_executable_values = VALUES(process.executable), |
| 63 | + Esql.host_id_values = VALUES(host.id), |
| 64 | + Esql.user_name_values = VALUES(user.name), |
| 65 | + Esql.destination_ip_values = VALUES(destination.ip) |
| 66 | + by Esql.source_ip |
| 67 | +| where Esql.event_module_distinct_count >= 2 |
| 68 | +| keep Esql.alerts_count, Esql.source_ip, Esql.destination_ip_values, Esql.host_id_values, Esql.user_name_values, Esql.event_module_values, Esql.message_values, Esql.process_executable_values |
| 69 | +''' |
| 70 | +note = """## Triage and analysis |
| 71 | +
|
| 72 | +### Investigating Elastic Defend and Network Security Alerts Correlation |
| 73 | +
|
| 74 | +This rule correlate any Elastic Defend alert with suspicious events from Network Security datasources like Palo Alto Networks (PANW), Fortinet Fortigate and Suricata by host.ip and source.ip. |
| 75 | +
|
| 76 | +### Possible investigation steps |
| 77 | +
|
| 78 | +- Review the alert details to identify the specific host and users involved. |
| 79 | +- Investiguate the network alerts by destination.ip and message. |
| 80 | +- Examine the timeline of the alerts to understand the sequence of events and determine if there is a pattern or progression in the tactics used. |
| 81 | +- Correlate the alert data with other logs and telemetry from the host, such as process creation, network connections, and file modifications, to gather additional context. |
| 82 | +- Check for any indicators of compromise (IOCs) associated with the alerts, such as suspicious IP addresses, domains, or file hashes, and search for these across the network. |
| 83 | +- Assess the impact and scope of the potential compromise by determining if other hosts or systems have similar alerts or related activity. |
| 84 | +
|
| 85 | +### False positive analysis |
| 86 | +
|
| 87 | +- IP address ranges overlap where the host.ip value from the Elastic Defend alert is unrelated to the source.ip value from the Network Security alert. |
| 88 | +- Alerts from routine administrative tasks may trigger multiple alerts. Review and exclude known benign activities such as scheduled software updates or system maintenance. |
| 89 | +- Security tools running on the host might generate alerts across different tactics. Identify and exclude alerts from trusted security applications to reduce noise. |
| 90 | +- Automated scripts or batch processes can mimic adversarial behavior. Analyze and whitelist these processes if they are verified as non-threatening. |
| 91 | +- Frequent alerts from development or testing environments can be misleading. Consider excluding these environments from the rule or applying a different risk score. |
| 92 | +- User behavior anomalies, such as accessing multiple systems or applications, might trigger alerts. Implement user behavior baselines to differentiate between normal and suspicious activities. |
| 93 | +
|
| 94 | +### Response and remediation |
| 95 | +
|
| 96 | +- Isolate the affected host from the network immediately to prevent further lateral movement by the adversary. |
| 97 | +- Conduct a thorough forensic analysis of the host to identify the specific vulnerabilities exploited and gather evidence of the attack phases involved. |
| 98 | +- Remove any identified malicious software or unauthorized access tools from the host, ensuring all persistence mechanisms are eradicated. |
| 99 | +- Apply security patches and updates to the host to address any exploited vulnerabilities and prevent similar attacks. |
| 100 | +- Restore the host from a known good backup if necessary, ensuring that the backup is free from compromise. |
| 101 | +- Monitor the host and network for any signs of re-infection or further suspicious activity, using enhanced logging and alerting based on the identified attack patterns. |
| 102 | +- Escalate the incident to the appropriate internal or external cybersecurity teams for further investigation and potential legal action if the attack is part of a larger campaign.""" |
| 103 | + |
| 104 | + |
| 105 | + |
0 commit comments