topic Re: Alert from which source/rule? in Cortex XDR Discussions

Alert from which source/rule?

RFeyertag — Thu, 04 Aug 2022 17:42:45 GMT

Hello!

We have some alerts which show us a large upload.

My problem is now, I saw other clients uploading a ton of bytes, but this Alert wasn't fired.

I also cannot find any Rule for this.

Where is it comming from?

Rob

Re: Alert from which source/rule?

afurze — Thu, 04 Aug 2022 18:05:18 GMT

Hi RFeyertag,

This is an Analytics alert, specifically Large Upload (https). The Analytics engine examines data from the XDR agents which have Pro capabilities enabled as well as NGFW logs if you have a Pro per TB license. The Analytics Engine creates a baseline of normal activity in the environment and then looks for anomalies, each alert has its own baseline period and test period, you can read more in the link above for this specific alert.

The rule does not look only at upload size, it is also looking for sites that clients are not uploading large amounts of data to and that the endpoint in question has not downloaded a large amount of data from. The check is to look for potential data exfiltration from your network.

Re: Alert from which source/rule?

RFeyertag — Thu, 04 Aug 2022 18:17:26 GMT

Thanks a lot! 😊

Re: Alert from which source/rule?

eluis — Fri, 05 Aug 2022 14:00:25 GMT

Hi @RFeyertag

Additionally to what Afurze mentioned (with very good criteria by the way) inspecting the alert on our documentation, please investigate the specific endpoint. And maybe talk to the user and/or manager of the endpoint group to see if this endpoint has changed the role in the organization, maybe now it is used to transfer legit info to a legit site ? (customer of yours, provider, other organization you cooperate with...) check with them and also with XDR if a new app has been installed there a bit earlier than the exfiltration ocurred, if the user logged in by the time of potential exfiltration was a legit one and also if the time of data transfer is "normal business hours??", check the type of loggin of the user by that time, was he sitting on the endpoint ? was it a remote/network login ? the IP of the connection in case of the user was remotely connecting ? is it legit location ?

Maybe investigating the CGO you can find the app/process that is the culprit of the suspicious action ?

Having our Identity Analytics (and so Cloud Identity Engine) enabled will also focus through AD data on the behaviour over time of the suspected user and endpoint.
Just some clues to perform the incident investigation and the determination of the actual root cause of the incident.

Hope this helps,

Luis