Cortex XDR - Brute force alert rule

[FabioFerreira]

Hi,

I need to create a brute force rule.

When endpoints with tag "CRITICAL" has "action_evtlog_description = An account failed to log on" and has more than 50 logs, create a CRITICAL alert.

Could you help pls.

Regards,

[bbucao]

Hi FabioFerreira,

I would recommend following the instructions linked here to build a correlation rule. You could try using the below query as a template for creating the correlation rule.

config case_sensitive = false
|dataset = xdr_data
|filter agent_hostname in(dataset = endpoints |filter tags contains "CRITICAL" |fields endpoint_name)
|filter action_evtlog_description = "An account failed to log on"
|comp count() as failure_count by agent_hostname
|filter failure_count > 50

Regards,
Ben

[FabioFerreira · Accepted solution]

Hi Ben,

Thank you for your help.

Did it with:

preset = xdr_event_log | filter action_evtlog_event_id = 4625 | filter agent_hostname in (dataset = endpoints | filter tags contains "CRITICAL" | fields endpoint_name)
//|alter actor_effective_username = action_evtlog_data_fields(to_json_string($.TargetUserName))
| alter TargetUserName = trim(json_extract(action_evtlog_data_fields, "$.TargetUserName"), "\"")
| alter ClientHostname = trim(json_extract(action_evtlog_data_fields, "$.WorkstationName"), "\"")
| alter ProcessName = trim(json_extract(action_evtlog_data_fields, "$.ProcessName"), "\"")
| fields agent_hostname, agent_ip_addresses, action_evtlog_description, TargetUserName, ClientHostname, insert_timestamp
| comp count(agent_hostname) as counter by agent_hostname,agent_ip_addresses,action_evtlog_description,TargetUserName,ClientHostname, insert_timestamp
| filter counter > 50

Regards,

Fábio