Alert Not Stitching (Custom Correlation Rule)

[G.Anshar]

Hello everyone, I have a question about alert stitching in Cortex XSIAM/XDR. I created two correlation rules:

1. Policy - Violation Root Detection (Medium severity)

2. Policy - Successful Sudo Command (Low severity)

However, when I check the incidents, the alerts are not being stitched together. I believe they should be stitched because the user, source IP, and host are the same. Can you please give me a reason or explanation 🙂 

[eluis]

Hi G.Anshar, 

Even if some alerts have same user, ip, hostname, might be they are not stitched to the same incident if XDR considers that they are not related to the same malicious activities, so 2 different incidents might be created for same hostname. 

You have the possibility to move alerts to other incidents if yoiu consider that some alerts should belong to other incidents. 

Bear in mind that low alerts do not create an incident. They could be stitched to an incident created by another alert of higher severity, or just stay as orphans (so to say) themselves without being stitched/included in any incident. 

Im not sure if you expected that alerts created by different correlation rules should be in the same incident if user name, ip, hostname are the same? 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR, 

Luis

[G.Anshar]

Hello Eluis, thanks for your answer.

"

---

@eluis wrote:

Im not sure if you expected that alerts created by different correlation rules should be in the same incident if user name, ip, hostname are the same? 

---

Yes, this is what I expected, because based on the raw event, the user successfully executed a sudo command. The command was /bin/su, which indicates a switch to the root user.

[eluis]

There many reasons why ML and AI could belive that they should be different incidents, Im not sure now the inner logic that might have triggered different incidents. 

For us, humans, it makes sense that if a user in linux tries to elavate privileges, same user, IP, hostname.... all should be grouped together under the same malicious activity and incident. 

Anyways you can group them manually at your convenience. 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR, 

Luis