Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Retrieval Rules #4324

Merged
merged 5 commits into from
Dec 19, 2024
Merged

[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Retrieval Rules #4324

merged 5 commits into from
Dec 19, 2024
+14 −12

Conversation

terrancedejesus
Copy link
Contributor

@terrancedejesus terrancedejesus commented Dec 19, 2024 •
edited
Loading

Pull Request

Issue link(s):

Summary - What I changed

Adjusted the from and interval times for rules per @approksiu.

How To Test

Queries were adjusted for format, but no logic changes.

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
  • Added the meta:rapid-merge label if planning to merge within 24 hours
  • Secret and sensitive material has been managed correctly
  • Automated testing was updated or added to match the most common scenarios
  • Documentation and comments were added for features that require explanation

Contributor checklist

@terrancedejesus terrancedejesus self-assigned this Dec 19, 2024
@terrancedejesus terrancedejesus marked this pull request as ready for review December 19, 2024 14:25
@terrancedejesus terrancedejesus added the Rule: Tuning tweaking or tuning an existing rule label Dec 19, 2024
@protectionsmachine
Copy link
Collaborator

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@Mikaayenson
Copy link
Contributor

Mikaayenson commented Dec 19, 2024 •
edited
Loading

@terrancedejesus With some simple logic, there are a few identified:

Details 

from detection_rules.rule_loader import RuleCollection
from detection_rules.utils import convert_time_span
rules = RuleCollection.default()


def convert_relative_delta(lookback: str) -> int:
    now = len("now")
    min_length = now + len('+5m')

    if lookback.startswith("now") and len(lookback) >= min_length:
        lookback = lookback[len("now"):]
        sign = lookback[0]  # + or -
        span = lookback[1:]
        amount = convert_time_span(span)
        return amount * (-1 if sign == "-" else 1)
    else:
        return convert_time_span(lookback)


for rule in rules.rules:
    to = convert_relative_delta(rule.contents.data.to) if rule.contents.data.to else 0
    from_ = convert_relative_delta(rule.contents.data.from_ or "now-6m")
    interval = convert_time_span(rule.contents.data.interval or "5m")
    if to - from_ <= interval:
        print(f"{rule.name} - {rule.id}")

My First Rule - a198fbbd-9413-45ec-a269-47ae4ccf59ce
Rapid Secret Retrieval Attempts from AWS SecretsManager - 185c782e-f86a-11ee-9d9f-f661ea17fbce
Multiple Okta Sessions Detected for a Single User - 621e92b6-7e54-11ee-bdc0-f661ea17fbcd
Query Registry using Built-in Tools - ded09d02-0137-4ccc-8005-c45e617e8d4c

Can you go ahead and fix the others?

FWIW, we could probably turn the code into a unit test. Starting in 8.18, when rules customization is released, the issue where this surfaces should be fixed by elastic/kibana#204317 .

@botelastic botelastic bot added the bbr Building Block Rules label Dec 19, 2024
terrancedejesus
terrancedejesus commented Dec 19, 2024
View reviewed changes
rules/cross-platform/guided_onboarding_sample_rule.toml Outdated
@@ -13,9 +13,9 @@ enabled = false
false_positives = [
"This rule is not looking for threat activity. Disable the rule if you're already familiar with alerts.",
]
from = "now-30m"
from = "now-1h"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@approksiu @Mikaayenson - If we want this different just let me know.

@maximpn maximpn mentioned this pull request Dec 19, 2024
Open
@terrancedejesus terrancedejesus merged commit dad008e into main Dec 19, 2024
9 checks passed
@terrancedejesus terrancedejesus deleted the rule-tuning-okta-multiple-sessions-for-single-user branch December 19, 2024 18:03
protectionsmachine pushed a commit that referenced this pull request Dec 19, 2024
@terrancedejesus @github-actions
[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Re…
d27f122 
…trieval Rules (#4324)

* rule tuning Okta and AWS lookback times

* adjusted Query Registry using Built-in Tools

* adjusted My First Rule

* Update rules/cross-platform/guided_onboarding_sample_rule.toml

Co-authored-by: Mika Ayenson <[email protected]>

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

Co-authored-by: Mika Ayenson <[email protected]>

---------

Co-authored-by: Mika Ayenson <[email protected]>

Removed changes from:
- rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

(selectively cherry picked from commit dad008e)
protectionsmachine pushed a commit that referenced this pull request Dec 19, 2024
@terrancedejesus @github-actions
[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Re…
302c3bf 
…trieval Rules (#4324)

* rule tuning Okta and AWS lookback times

* adjusted Query Registry using Built-in Tools

* adjusted My First Rule

* Update rules/cross-platform/guided_onboarding_sample_rule.toml

Co-authored-by: Mika Ayenson <[email protected]>

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

Co-authored-by: Mika Ayenson <[email protected]>

---------

Co-authored-by: Mika Ayenson <[email protected]>

Removed changes from:
- rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

(selectively cherry picked from commit dad008e)
protectionsmachine pushed a commit that referenced this pull request Dec 19, 2024
@terrancedejesus @github-actions
[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Re…
18da8f1 
…trieval Rules (#4324)

* rule tuning Okta and AWS lookback times

* adjusted Query Registry using Built-in Tools

* adjusted My First Rule

* Update rules/cross-platform/guided_onboarding_sample_rule.toml

Co-authored-by: Mika Ayenson <[email protected]>

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

Co-authored-by: Mika Ayenson <[email protected]>

---------

Co-authored-by: Mika Ayenson <[email protected]>

Removed changes from:
- rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

(selectively cherry picked from commit dad008e)
protectionsmachine pushed a commit that referenced this pull request Dec 19, 2024
@terrancedejesus @github-actions
[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Re…
ea54e84 
…trieval Rules (#4324)

* rule tuning Okta and AWS lookback times

* adjusted Query Registry using Built-in Tools

* adjusted My First Rule

* Update rules/cross-platform/guided_onboarding_sample_rule.toml

Co-authored-by: Mika Ayenson <[email protected]>

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

Co-authored-by: Mika Ayenson <[email protected]>

---------

Co-authored-by: Mika Ayenson <[email protected]>

(cherry picked from commit dad008e)
protectionsmachine pushed a commit that referenced this pull request Dec 19, 2024
@terrancedejesus @github-actions
[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Re…
2974182 
…trieval Rules (#4324)

* rule tuning Okta and AWS lookback times

* adjusted Query Registry using Built-in Tools

* adjusted My First Rule

* Update rules/cross-platform/guided_onboarding_sample_rule.toml

Co-authored-by: Mika Ayenson <[email protected]>

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

Co-authored-by: Mika Ayenson <[email protected]>

---------

Co-authored-by: Mika Ayenson <[email protected]>

(cherry picked from commit dad008e)
protectionsmachine pushed a commit that referenced this pull request Dec 19, 2024
@terrancedejesus @github-actions
[Rule Tuning] Lookback Times for Okta Multiple Session and AWS KMS Re…
f23d332 
…trieval Rules (#4324)

* rule tuning Okta and AWS lookback times

* adjusted Query Registry using Built-in Tools

* adjusted My First Rule

* Update rules/cross-platform/guided_onboarding_sample_rule.toml

Co-authored-by: Mika Ayenson <[email protected]>

* Update rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml

Co-authored-by: Mika Ayenson <[email protected]>

---------

Co-authored-by: Mika Ayenson <[email protected]>

(cherry picked from commit dad008e)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@Samirbous Samirbous Samirbous approved these changes

@approksiu approksiu Awaiting requested review from approksiu

@imays11 imays11 Awaiting requested review from imays11

@Aegrah Aegrah Awaiting requested review from Aegrah

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

Assignees

@terrancedejesus terrancedejesus

Labels
backport: auto bbr Building Block Rules Domain: Cloud Domain: SaaS Integration: AWS AWS related rules Integration: Okta okta related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@terrancedejesus @protectionsmachine @Mikaayenson @Samirbous