Elastic high stable kql

Multiple Alerts Involving a User

This rule uses alert data to determine when multiple different alerts involving the same user are triggered. Analysts can use this to prioritize triage and response, as these users are more likely to be compromised.

View Source

Detection Logic

from .alerts-security.*
| where kibana.alert.rule.name is not null and user.id is not null and
  // Exclude low severity alerts
  kibana.alert.risk_score > 21 and
  not KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """)
| stats
    Esql.kibana_alert_rule_name_distinct_count = COUNT_DISTINCT(kibana.alert.rule.name), 
    Esql.kibana_alert_rule_rule_id_distinct_count = COUNT_DISTINCT(kibana.alert.rule.rule_id),
    Esql.host_id_distinct_count = COUNT_DISTINCT(host.id),
    Esql.kibana_alert_risk_score_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
    Esql.event_dataset_distinct_count = COUNT_DISTINCT(event.dataset),
    Esql.kibana_alert_rule_name_values = VALUES(kibana.alert.rule.name), 
    Esql.kibana_alert_risk_score_values = VALUES(kibana.alert.risk_score), 
    Esql.event_dataset_values = VALUES(event.dataset),
    Esql.event_module_values = VALUES(event.module), 
    Esql.process_command_line_values = VALUES(process.command_line), 
    Esql.host_id_values = VALUES(host.id), 
    Esql.source_ip_values = VALUES(source.ip), 
    Esql.destination_ip_values = VALUES(destination.ip) by user.id, user.name
| where Esql.kibana_alert_rule_name_distinct_count >= 4 
AND Esql.kibana_alert_rule_rule_id_distinct_count >= 2 and
 // Exclude known system accounts with matches in more than one host
 not (
   (length(TO_STRING(user.id)) <= 4 or user.id IN ("S-1-5-18", "S-1-5-19", "S-1-5-20", "0")) and
   (Esql.host_id_distinct_count >= 2 or Esql.host_id_distinct_count == 0)
 )
| keep user.id, user.name, Esql.*

Field Validations

Loading…

Comments (0)

Loading comments...