ir.general first_carve

[RSAAdmin]

I was looking through some logs, and noticed that some of the ir.general fields are populated with 'first_carve', and 'first_carve_!dns'. Does anybody know what these mean?

[Anonymous]

Yes.  From my observations, that meta is created for analysts (IR) to perform a first round of meta reduction from the field of view. By creating those kinds of tactical pivots, analysts can exclude a lot of data that may not be necessary for an initial triage assessment.

For example, if I wanted to focus on outbound traffic of my users, I would look for RFC1918 addresses as a source and something OTHER than an RFC1918 as a destination.

The 'ir.general' meta key is a custom meta key that can be used by analysts to carve up data they know about their networks for either inclusion or exclusion in other searches.

Chris

[RSAAdmin]

thanks chris! So, I get that the IR general provides more context, but what would the keys 'first_carve', and 'first_carve_!dns'. mean?

[Anonymous]

I believe those are application rules, so you could check in the decoder for the exact content.  Those are to create meta around sessions that would typically be excluded. 

Typically, you would right-click !EXISTS on that meta value (first_carve) and reduce the amount of data to sift through.

They could also be used in other application rules to further refine those rules and provide better focus on specific content you would be looking for.