topic Re: Cortex XDR Correlation rule to detect /alert if a user logon to multiple endpoints at a time in Cortex XDR Discussions

Cortex XDR Correlation rule to detect /alert if a user logon to multiple endpoints at a time

Sree Rag R — Thu, 22 Feb 2024 12:40:47 GMT

Hi ,

Can anybody help to create a Cortex XDR Correlation rule using XQL to detect /alert if a user logon to multiple endpoints at a time

Thanks in advance.

Regards

Sree Rag R

Re: Cortex XDR Correlation rule to detect /alert if a user logon to multiple endpoints at a time

nsinghvirk — Tue, 27 Feb 2024 13:52:07 GMT

Hello @Sree Rag R

Thanks for reaching out on LiveCommunity!

I have a created a XQL query which you can use as reference to create your own correlation rule.

dataset = endpoints
| filter (user not in (null, """"""))
| comp count(endpoint_name) as NumOfComputer by user
| filter NumOfComputer > 1
| fields user , NumOfComputer

This query will list the users who have logged on more then one endpoints.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Cortex XDR Correlation rule to detect /alert if a user logon to multiple endpoints at a time

aspatil — Tue, 27 Feb 2024 15:08:06 GMT

Hello @Sree Rag R ,

This the more kind SIEM or Identity Protection requirement. However, you can try below and see if this meets your requirement:

config timeframe between "10m" and "now" //update this timeframe for the interval you are looking
|dataset = xdr_data
| filter event_type = EVENT_LOG AND action_evtlog_event_id = 4625 // Filtering by failed logon events`
| alter User_Name = arrayindex(regextract(action_evtlog_message,"Account For Which Logon Failed:\r\n.*\r\n.*?Account Name:.*?(\w.*?)\r\n"),0)
| comp count_distinct(agent_hostname ) as host_count by User_Name
| filter host_count >1

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Cortex XDR Correlation rule to detect /alert if a user logon to multiple endpoints at a time

Sree Rag R — Wed, 28 Feb 2024 10:49:50 GMT

Hi Nsinghvirk,

Thanks for the revert. As u said this is listing the users who have logged on more then one endpoints.

If u provide solution for displaying Endpoint name along with the result that would be more helpful.

Regards

Sree Rag R

Re: Cortex XDR Correlation rule to detect /alert if a user logon to multiple endpoints at a time

ithermos — Wed, 28 Feb 2024 11:47:45 GMT

In general, you will have an Investigation/Alert Query on the Correlation rule, that will have the events ungrouped and thus showcasing the Endpoint names.

So, write a similar query without the counters and select the desired fields, inside the Correlation rule which will have as a main/logic query one of those mentioned in the previous replies (two queries in total).