Elastic high stable kql

Multiple External EDR Alerts by Host

This rule uses alert data to determine when multiple external EDR alerts involving the same host are triggered. Analysts can use this to prioritize triage and response, as these hosts are more likely to be compromised.

View Source

Detection Logic

from .alerts-security.*
| WHERE event.dataset in ("crowdstrike.alert", "crowdstrike.falcon", "sentinel_one.alert", "sentinel_one.threat", "m365_defender.alert") and
        host.id is not null and kibana.alert.risk_score > 21 and
        not (event.module == "crowdstrike" and (kibana.alert.rule.name like "* at *" or kibana.alert.rule.name like "* on *" or kibana.alert.rule.name == "EICARTestFileWrittenWin")) and
        not KQL("""kibana.alert.rule.tags : "Rule Type: Higher-Order Rule" """)
| stats Esql.alerts_count = COUNT(*),
       Esql.kibana_alert_risk_score_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
       Esql.kibana_alert_rule_name_distinct_count = COUNT_DISTINCT(kibana.alert.rule.name),
       Esql.process_executable_distinct_count = COUNT_DISTINCT(process.executable),
       Esql.file_path_distinct_count = COUNT_DISTINCT(file.path),
       Esql.process_command_line_distinct_count = COUNT_DISTINCT(process.command_line),
       Esql.kibana_alert_risk_score_values = VALUES(kibana.alert.risk_score),
       Esql.process_executable_values = VALUES(process.executable),
       Esql.file_path_values = VALUES(file.path),
       Esql.user_name_values = VALUES(user.name),
       Esql.process_command_line_values = VALUES(process.command_line),
       Esql.process_parent_command_line_values = VALUES(process.parent.command_line),
       Esql.kibana_alert_rule_name_values = VALUES(kibana.alert.rule.name) by host.id, host.name, event.module
| where (
	// 3+ unique rules or processes
 (
   Esql.kibana_alert_rule_name_distinct_count >= 3 or
   (Esql.process_executable_distinct_count >= 3 and Esql.kibana_alert_rule_name_values == "External Alerts")
 ) and
 	// and 2+ rules of different severity, or 1 high/critical severity rule
 (
   Esql.kibana_alert_risk_score_distinct_count >= 2 or
   Esql.kibana_alert_risk_score_values == 73 or
   Esql.kibana_alert_risk_score_values == 99
 )
) or
 // or 5+ unique rules from the same host for 1+ path/command_line/process
 (Esql.kibana_alert_rule_name_distinct_count >= 5 and Esql.alerts_count <= 50 and
 (Esql.file_path_distinct_count >= 1 or  Esql.process_command_line_distinct_count >= 1 or Esql.process_executable_distinct_count >= 1)
)
| KEEP event.module, host.id, host.name, Esql.*

Field Validations

Loading…

Comments (0)

Loading comments...