ESA alert not triggering

[RSAAdmin]

Hi all,

I have created a simple alert in ESA, however it is not triggering at all. The meta keys used in correlation are device_type and ec_outcome and it needs to trigger when it reaches as a threshold of say 50 events. Rule shows as valid.

Can someone help me with some pointers as to why this is not trigerring?

Please refer attached images showing correlation rule and sample log file with meta key details

Thanks in advance!!

[LeeKirkpatrick · Accepted solution]

Hey,

I can see in your screenshot you have selected "ec_outcome IS n". But in your logs it is 'N'.

ESA is cAsE sensitive. Change that and you should be set...

[RSAAdmin]

Thanks Lee, It worked, actually in investigation tab its showing as 'n' That's why I put it as 'n'

[LeeKirkpatrick]

Glad to hear!

It is a little confusing. The Investigation view will convert all Meta to lowercase. If you drill down to the event view and view the Meta there, you would see the actual case.

[RSAAdmin]

Hello,

I have another challenge based on same logs above, This looks impossible

I need to generate an alert or report for IP addresses with ec_outcome = 'Y' && 'N' for a timeperiod say 60 minutes. Basically we need to track IPs from which both success and failed logins have been made on userIDs. We are seeing attempts of 100 plus userIDs from an IP out of which 2-3 are success or the second scenario is usual bruteforce type events.

I tried few queries using advanced as normal queries are not triggering anything

SELECT * FROM Event(

            (device_type IN ( 'logsource' ) AND ec_outcome IN ( 'N' , 'Y' )))

.std:groupwin(ip_src).win:time_length_batch(5 Minutes, 10)

.std:unique(device_ip) group by ip_src having count(*) = 10;

SELECT * FROM Event(

            /* Statement: logsource Success or Failed Login */

            (device_type IN ( 'logsource' ) AND ec_outcome IN ( 'N' , 'Y' )))

        .std:groupwin(ip_src)

        .win:time_length_batch(5 Minutes, 10)

        GROUP BY ip_src

        HAVING COUNT(*) >= 10;

SELECT * FROM PATTERN [ every-distinct(ip_src, 60 Minutes)

            (

            /* Statement: logsource failed event */

            e1=Event(device_type IN ( 'logsource' ) AND ec_outcome IN ( 'N' ) )

            -> timer:interval(60 Minutes) AND

            /* Statement: logsource success event */

            e2=Event(device_type IN ( 'logsource' ) AND ec_outcome IN ( 'Y' ) )

            )

        ];

[LeeKirkpatrick]

Hey,

The middle query you have written looks fine:

SELECT * FROM Event(

            /* Statement: logsource Success or Failed Login */

            (device_type IN ( 'logsource' ) AND ec_outcome IN ( 'N' , 'Y' )))

        .std:groupwin(ip_src)

        .win:time_length_batch(5 Minutes, 10)

        GROUP BY ip_src

        HAVING COUNT(*) >= 2;

Maybe try reducing the HAVING COUNT(*) to confirm but this should be firing on 10 ec_outcome 'Y','N' events from the same ip_src.