While there is not currently a method to extract non-aggregated (i.e.: not in an incident) alert data via API, I can say that work on this need is underway and should be included in an upcoming release.
As for UEBA alert grouping, I have a few modifications I've made to the Respond normalization and and aggregation schema files. Some docs and guides for this process here:
- https://community.rsa.com/t5/rsa-netwitness-platform-online/netwitness-respond-configuration-guide-for-rsa-netwitness/ta-p/572862
- https://community.rsa.com/t5/rsa-netwitness-platform-blog/creating-custom-match-condition-and-group-by-fields-for-respond/ba-p/518604
In my custom_normalize_ueba_alerts.js file, I have:
exports.normalizeAlert = function(headers, rawAlert, normalizedAlert) {
// normalizedAlert is the copy of ootb normalizer alert, make sure you use
// normalizedAlert object to update/set the values in your scripts
var normalized = Object.assign(normalizedAlert);
// Add custom logic below
var event = new Object();
normalized.custom_events = new Array();
for (var i = 0; i < rawAlert.events.length; i++) {
event = generateEventInfo(headers, rawAlert, normalizedAlert.events[i]);
normalized.custom_events.push(event);
}
return normalized;
};
generateEventInfo = function(headers, rawAlert, event) {
var normalizedEvent = {
entity_name: Utils.stringValue(rawAlert.entityName),
ueba_schema: Utils.stringValue(rawAlert.schema)
};
return normalizedEvent;
};
In my custom_normalize_alerts.js file, I have:
function normalizeAlert(headers, alert, normalizedAlert) {
var transformer = null;
...snip....
// Normalize
var normalized = transformer.normalizeAlert(headers, alert, normalizedAlert);
// Add custom logic below
normalized.groupby_entity_name = Utils.generateFlattenedColumnValue(normalized.custom_events, "entity_name");
normalized.groupby_ueba_schema = Utils.generateFlattenedColumnValue(normalized.custom_events, "ueba_schema");
return normalized;
}
}
And in my aggregation_rule_schema.json file, I have:
...snip...
{
"value": "alert.groupby_entity_name",
"name": "UEBA Entity Name",
"type": "textfield",
"operators": [0, 1, 8, 9, 10, 11, 12, 13],
"groupBy": true,
"groupByField": "alert.groupby_entity_name"
},
{
"value": "alert.groupby_ueba_schema",
"name": "UEBA Schema Type",
"type": "textfield",
"operators": [0, 1, 8, 9, 10, 11, 12, 13],
"groupBy": true,
"groupByField": "alert.groupby_ueba_schema"
}
...snip...
Once you make these changes, you'll need to restart the respond-server on your Node0 for them to take effect:
[root@nwadmin ~]# systemctl restart rsa-nw-respond-server
Lastly, in the UI at Configure/Incident Rules, I have different aggregation rules for each schema category (Network: TLS; Users: AUTHENTICATION & FILE & ACTIVE_DIRECTORY; Endpoint: PROCESS & REGISTRY )
USER
NETWORK
ENDPOINT
All this gets me incidents like this:
