How to compare two meta of the same event ?

[RSAAdmin]

Hi,

I am trying to build a correlation rule where in  need to compare the values of two meta of the same event using the operator >.

How to achieve this use case in Security Analytics

Regards

Shanthi

[Anonymous]

I don't think you can do that. That's the job for the parsers.

[LeeKirkpatrick]

Hi Shanthi,

Firstly, you would need an Event Stream Analysis (ESA) appliance to do this correlation.

Secondly, you will need to utilise the advanced rule builder for this purpose. An example of this is below:-

@Name('Five Failed Logins from the Same User within 5 minutes')

@RSAAlert

SELECT * FROM pattern[Every (s1=Event(user_dst IS NOT NULL AND event_cat_name='User.Activity.Failed Logins')) -> [4]Event(user_dst=s1.user_dst AND event_cat_name='User.Activity.Failed Logins') WHERE time:within(5 min)];

Here I am comparing the second statements user_dst value to that we matched on the first. See bold text.

The language being used is Esper Processing Language, a full reference can be found here:-

Esper Reference

[EricPartington]

11.0 now allows you to compare two metakeys in apprule syntax

user.src != user.dst 

for example.  Other operators are available just like other application rules

[robertofasciani]

Hi Shanthi,

if you want compare two meta of the same event, you will utilise the advanced rule like this:

@RSAAlert
SELECT * FROM Event (
ip_srcport < ip_dstport);

[Anonymous]

If you did want to do it via a parser, it might look something like this.

============================================

local lua_client_server_compare = nw.createParser("lua_client_server_compare", "Compare client and server meta in a given session.")

-- Write meta into the following meta key(s)
lua_client_server_compare:setKeys({
nwlanguagekey.create("boc",nwtypes.Text),
})

function lua_client_server_compare:sessionBegin()
-- reset parser_state for the new session
client = nil
server = nil
end

function lua_client_server_compare:clientMeta(index, meta)
client = meta
if server then
if client == server then
nw.createMeta(self.keys["boc"], "client_eq_server")
end
end
end

function lua_client_server_compare:serverMeta(index, meta)
server = meta
if client then
if server == client then
nw.createMeta(self.keys["boc"], "client_eq_server")
end
end
end

-- declare what tokens and events we want to match
lua_client_server_compare:setCallbacks({
[nwevents.OnSessionBegin] = lua_client_server_compare.sessionBegin,
[nwlanguagekey.create("client")] = lua_client_server_compare.clientMeta,
[nwlanguagekey.create("server")] = lua_client_server_compare.serverMeta,
})

============================================

In this parser, we use meta callbacks of previously created meta for that session.  Here, I am comparing client and server meta, but it could be modified to compare meta from any two keys.  Please note, it would have to be exact matches.

Chris