Elastic high deprecated kql

Multiple Alerts in Different ATT&CK Tactics on a Single Host

This rule uses alert data to determine when multiple alerts in different phases of an attack involving the same host are triggered. Analysts can use this to prioritize triage and response, as these hosts are more likely to be compromised.

View Source

Detection Logic

signal.rule.name:* and kibana.alert.rule.threat.tactic.id:* and host.id:* and host.name:* and
event.dataset:* and kibana.alert.risk_score > 21 and
not kibana.alert.rule.type:(threat_match or machine_learning)

False Positives

⚠ False positives can occur because the rules may be mapped to a few MITRE ATT&CK tactics. Use the attached Timeline to determine which detections were triggered on the host.

Field Validations

Loading…

Comments (0)

Loading comments...