Fields Reference
name This is the name that we will use for the alerts of the current rule. severity The severity of the alerts for this rule. Use the majuscule initial. Possible values: Low, Medium, High. description The description that will appear in the alerts. solution If there is a known solution for this incident, specify here. category If there is any category in which the alert can be grouped. tactic If there is an incident detected by this rule fits into any of the attack tactics. dataTypes Group of datatypes applied to a rule, means that only the logs with dataType field matching with at least one of these values will be processed by this rule. This field is an array of string values, so, you can place more than one value separated by comma. Reference A list of URLs where you can get more information about the attack. frequency How often in seconds the alert should be checked. cache This field declares that the iterations will occur on the cache of the correlation engine and contains the definition of said iterations. When this field is used, the search field is not used and vice versa. cache -> allOf All comparisons within this field must be met for the rule to generate an alert. cache -> oneOf Any comparison within this field must be met for the rule to generate an alert.cache -> [allOf | oneOf] -> fieldThe field on which the comparison will be applied. A field is a series of keys separated by dots. It can contain special wildcard characters ’*’ and ’?’. To access a slice value, use the index as the key. To get the number of elements in a slice or to access a child path, use the ’#’ character. Dot and wildcard characters can be escaped with ’\’. You can also query a slice for the first match using # (…), or find all matches with # (…) #. You can use the comparison operators
(==,!=, <, <=,>,>=) and the simple pattern matching operators (% and !%).
This description also applies to \[cache | search\] -> save -> field
cache -> [allOf | oneOf] -> operatorOperator to use in the comparison. See information about the operators in Operators
cache -> [allOf | oneOf] -> valueValue to compare the content of “cache -> [allOf | oneOf] -> field”. In the second iteration case or onwards, you can use an alias to use the content of that alias as a value.
cache -> timeLapseHow much time backward in seconds will be checked in the logs.
[cache | search] -> minCountHow many minimum logs must be obtained as a result for this rule to be met.
[cache | search] -> saveRequired fields to save to use in the next cycle iteration or to complete the information of the alerts.
[cache | search] -> save -> fieldThe original name of the field to store.
[cache | search] -> save -> aliasThe alias or name to access the field. There cannot be two or more aliases with the same name within the same iteration. In the last iteration, the system will use the following aliases to fill in the alert details:
- Protocol
- SourceUser
- SourceHost
- SourceIP
- SourcePort
- DestinationUser
- DestinationHost
- DestinationIP
- DestinationPort
Operators
== It’s true if the field’s content is exactly equal to “value” content. It is sensitive to capital letters.- hello == Hello //False
- hello == hello //True
- hello :: Hello //True
- hello :: hello //True
**!= y <>**
It’s true if the field’s content is unequal to “value” content. It is sensitive to capital letters.
- hello != Hello //True
- hello != hello //False
- hello !! Hello //False
- hello !! hello //False
- “hello world” contains “world” //True
- “hello world” contains “worlds” //False
- ” hello world ” not contain ” world ” //False
- ” hello world ” not contain ” worlds” //True
- ” world ” in “hello, world, this, is, a, test” //True
- ” worlds” in “hello, world, this, is, a, test” //False
- ” world” not in “hello, world, this, is, a, test ” //False
- ” worlds” not in “hello, world, this, is, a, test ” //True
- ” hello world ” start with ” world ” //False
- ” hello world ” start with “hello” //True
- ” hello world ” not start with ” world ” //True
- ” hello world ” not start with ” hello ” //False
- ” hello world ” end with ” world ” //True
- ” hello world ” end with “hello” //False
- ” hello world ” not end with ” world ” //False
- ” hello world ” not end with ” hello ” //True
- “adam[23]” regexp ”^[a-z]+\[[0-9]+\]$” //True
- ” hello world ” regexp ”^[a-z]+\[[0-9]+\]$” //False
- “adam[23]” not regexp ”^[a-z]+\[[0-9]+\]$” //False
- ” hello world ” not regexp ”^[a-z]+\[[0-9]+\]$” //True
Classic mathematical operators that only apply to numbers. Use only when the field content and the “value” are numeric.
<\><=\>=