Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Updated setup guide #3885

Merged
merged 5 commits into from
Jul 17, 2024
Merged

[Rule Tuning] Updated setup guide #3885

merged 5 commits into from
Jul 17, 2024

Conversation

Aegrah
Copy link
Contributor

@Aegrah Aegrah commented Jul 11, 2024

Summary

Added setup guide instructions to this rule, to allow customers to more easily set up the necessary auditd rules.

@Aegrah Aegrah added OS: Linux Rule: Tuning tweaking or tuning an existing rule labels Jul 11, 2024
@Aegrah Aegrah self-assigned this Jul 11, 2024
@protectionsmachine
Copy link
Collaborator

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@approksiu
Copy link

@Aegrah could you please follow the setup guide template mentioned in this issue: https://github.com/elastic/ia-trade-team/issues/410

@Aegrah
Copy link
Contributor Author

Aegrah commented Jul 11, 2024

@approksiu copy pasted it from the template now.

shashank-elastic
shashank-elastic reviewed Jul 17, 2024
View reviewed changes
rules/linux/persistence_user_or_group_creation_or_modification.toml
setup = """## Setup
This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.
setup = """### Auditd Manager Integration Setup
The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The format seems a bit off from the templates we have here

Its good to keep it consistent across the rules, if we dont have a specific reason as to why this has changed here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I copy pasted it from that doc..

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have added the suggestion on what was missing

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I implemented your change, but I don't see that line in the document you shared. Doing a ctrl + f in that document also does not return any hits.

We might have to change the template document if the document is wrong!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed on slack. This was a more of a main section introduction missing!

shashank-elastic
shashank-elastic approved these changes Jul 17, 2024
View reviewed changes
Copy link
Contributor

@shashank-elastic shashank-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving : Post committing the Setup Suggestions

@Aegrah @shashank-elastic
Update rules/linux/persistence_user_or_group_creation_or_modification…
f2be2c9 
….toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
@Aegrah Aegrah merged commit e5d08a2 into main Jul 17, 2024
9 checks passed
@Aegrah Aegrah deleted the setup_guide-update-dr branch July 17, 2024 12:39
protectionsmachine pushed a commit that referenced this pull request Jul 17, 2024
@Aegrah @github-actions
[Rule Tuning] Updated setup guide (#3885)
4c8fe8a 
* [Rule Tuning] Updated setup guide

* Update persistence_user_or_group_creation_or_modification.toml

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit e5d08a2)
protectionsmachine pushed a commit that referenced this pull request Jul 17, 2024
@Aegrah @github-actions
[Rule Tuning] Updated setup guide (#3885)
529a985 
* [Rule Tuning] Updated setup guide

* Update persistence_user_or_group_creation_or_modification.toml

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit e5d08a2)
protectionsmachine pushed a commit that referenced this pull request Jul 17, 2024
@Aegrah @github-actions
[Rule Tuning] Updated setup guide (#3885)
61bc691 
* [Rule Tuning] Updated setup guide

* Update persistence_user_or_group_creation_or_modification.toml

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit e5d08a2)
protectionsmachine pushed a commit that referenced this pull request Jul 17, 2024
@Aegrah @github-actions
[Rule Tuning] Updated setup guide (#3885)
bcb9209 
* [Rule Tuning] Updated setup guide

* Update persistence_user_or_group_creation_or_modification.toml

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit e5d08a2)
protectionsmachine pushed a commit that referenced this pull request Jul 17, 2024
@Aegrah @github-actions
[Rule Tuning] Updated setup guide (#3885)
afd115b 
* [Rule Tuning] Updated setup guide

* Update persistence_user_or_group_creation_or_modification.toml

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit e5d08a2)
protectionsmachine pushed a commit that referenced this pull request Jul 17, 2024
@Aegrah @github-actions
[Rule Tuning] Updated setup guide (#3885)
42532b2 
* [Rule Tuning] Updated setup guide

* Update persistence_user_or_group_creation_or_modification.toml

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

* Update rules/linux/persistence_user_or_group_creation_or_modification.toml

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

(cherry picked from commit e5d08a2)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@shashank-elastic shashank-elastic shashank-elastic approved these changes

@imays11 imays11 imays11 approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@terrancedejesus terrancedejesus Awaiting requested review from terrancedejesus

Assignees

@Aegrah Aegrah

Labels
backport: auto Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@Aegrah @protectionsmachine @approksiu @imays11 @shashank-elastic