Elastic high stable kql

Multiple Elastic Defend Alerts by Agent

This rule uses alert data to determine when multiple alerts from Elastic Defend involving the same host are triggered. Analysts can use this to prioritize triage and response, as these hosts are more likely to be compromised.

View Source

Detection Logic

from logs-endpoint.alerts-* metadata _id
| eval target_time_window = DATE_TRUNC(24 hours, @timestamp)
| where event.code in ("malicious_file", "memory_signature", "shellcode_thread", "behavior") and
        agent.id is not null and not rule.name in ("Multi.EICAR.Not-a-virus")
| stats Esql.alerts_count = COUNT(*),
        Esql.event_code_distinct_count = count_distinct(event.code),
        Esql.rule_name_distinct_count = COUNT_DISTINCT(rule.name),
        Esql.file_hash_distinct_count = COUNT_DISTINCT(file.hash.sha256),
        Esql.process_name_distinct_count = COUNT_DISTINCT(process.entity_id),
        Esql.event_code_values = VALUES(event.code),
        Esql.rule_name_values = VALUES(rule.name),
        Esql.message_values = VALUES(message),
        Esql.file_path_values = VALUES(file.path),
        Esql.dll_path_values = VALUES(dll.path),
        Esql.process_executable_values = VALUES(process.executable),
        Esql.process_parent_executable_values = VALUES(process.parent.executable),
        Esql.process_command_line_values = VALUES(process.command_line),
        Esql.process_hash_sha256_values = VALUES(process.hash.sha256),
        Esql.file_hash_sha256_values = VALUES(file.hash.sha256),
        Esql.dll_hash_sha256_values = VALUES(dll.hash.sha256) by agent.id
| where (Esql.event_code_distinct_count >= 2 or Esql.rule_name_distinct_count >= 3 or Esql.file_hash_distinct_count >= 2)
| keep agent.id,
       Esql.alerts_count,
       Esql.event_code_distinct_count,
       Esql.rule_name_distinct_count,
       Esql.message_values,
       Esql.event_code_values,
       Esql.rule_name_values,
       Esql.process_executable_values,
       Esql.process_parent_executable_values,
       Esql.process_command_line_values,
       Esql.file_path_values,
       Esql.dll_path_values,
       Esql.process_hash_sha256_values,
       Esql.file_hash_sha256_values,
       Esql.dll_hash_sha256_values

Field Validations

Loading…

Comments (0)

Loading comments...