Elastic high stable kql

Alerts From Multiple Integrations by Source Address

This rule uses alert data to determine when multiple alerts from different integrations with unique event categories and involving the same source.ip are triggered. Analysts can use this to prioritize triage and response, as these IP addresses are more likely to be related to a compromise.

View Source

Detection Logic

from .alerts-security.*

// any alerts excluding low severity and the noisy ones
| where kibana.alert.rule.name is not null and source.ip is not null and kibana.alert.risk_score > 21 and
        not kibana.alert.rule.type in ("threat_match", "machine_learning") and
        not KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """)

// group alerts by source.ip and extract values of interest for alert triage
| stats Esql.event_module_distinct_count = COUNT_DISTINCT(event.module),
        Esql.rule_name_distinct_count = COUNT_DISTINCT(kibana.alert.rule.name),
        Esql.event_category_distinct_count = COUNT_DISTINCT(event.category),
        Esql.rule_risk_score_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
        Esql.event_module_values = VALUES(event.module),
        Esql.rule_name_values = VALUES(kibana.alert.rule.name),
        Esql.message_values = VALUES(message),
        Esql.event_category_values = VALUES(event.category),
        Esql.event_action_values = VALUES(event.action),
        Esql.destination_ip_values = VALUES(destination.ip),
        Esql.host_id_values = VALUES(host.id),
        Esql.agent_id_values = VALUES(agent.id),
        Esql.user_name_values = VALUES(user.name),
        Esql.rule_severity_values = VALUES(kibana.alert.risk_score) by source.ip

// filter for alerts from same source.ip reported by different integrations with unique categories and with different severity levels
| where Esql.event_module_distinct_count >= 2 and Esql.event_category_distinct_count >= 2 and (Esql.rule_risk_score_distinct_count >= 2 or Esql.rule_severity_values == 73 or Esql.rule_severity_values == 99)
| keep source.ip, Esql.*

Field Validations

Loading…

Comments (0)

Loading comments...