Cortex XDR Correlation rule to detect /alert if a user logon to multiple endpoints at a time

[Sree Rag R]

Hi ,

Can anybody help to create a Cortex XDR Correlation rule using XQL to detect /alert if a user logon to multiple endpoints at a time

Thanks in advance.

Regards

Sree Rag R

[nsinghvirk]

Hello @Sree Rag R 

Thanks for reaching out on LiveCommunity!

I have a created a XQL query which you can use as reference to create your own correlation rule.

dataset = endpoints
| filter (user not in (null, """"""))
| comp count(endpoint_name) as NumOfComputer by user
| filter NumOfComputer > 1
| fields user , NumOfComputer

This query will list the users who have logged on more then one endpoints.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[aspatil]

Hello @Sree Rag R ,

This the more kind SIEM or Identity Protection requirement. However, you can try below and see if this meets your requirement:

config timeframe between "10m" and "now"  //update this timeframe for the interval you are looking
|dataset = xdr_data
| filter event_type = EVENT_LOG AND action_evtlog_event_id = 4625 // Filtering by failed logon events`
| alter User_Name = arrayindex(regextract(action_evtlog_message,"Account For Which Logon Failed:\r\n.*\r\n.*?Account Name:.*?(\w.*?)\r\n"),0)
| comp count_distinct(agent_hostname ) as host_count by User_Name
| filter host_count >1

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[Sree Rag R]

Hi Nsinghvirk,

Thanks for the revert. As u said this is listing the users who have logged on more then one endpoints. 

If u provide solution for displaying Endpoint name along with the result that would be more helpful.

Regards

Sree Rag R

[ithermos]

In general, you will have an Investigation/Alert Query on the Correlation rule, that will have the events ungrouped and thus showcasing the Endpoint names.

So, write a similar query without the counters and select the desired fields, inside the Correlation rule which will have as a main/logic query one of those mentioned in the previous replies (two queries in total).