Help with t XQL BIOC/Correlation rule

[AshokBabu]

Hi ALL,

New to XDR world,  

I am have a XQL query against a 2FA log which looks for user login (fail or success) from 2 different countries in 3 hours. 

Query looks like  

dataset in (XXX_raw)
| filter eventType = "User.Login" // look for  login events
| comp min(_time) as Firsttime, max(_time) as Lasttime, count_distinct(country) as location_count, values(state) AS states, values(city) AS cities , values(result) AS results by user_name
| filter location_count > 1 and timestamp_diff(Lasttime, Firsttime, "HOUR") < 3

Things are fine the "Query Builder" now I want to move it to an alert/rule. 

Looks like I can't set  BIOC rules bcoz
"you can create BIOC rules using the xdr_data and cloud_audit_log datasets and presets for these datasets. Currently, you cannot create a BIOC rule on customized datasets and only the filter stage, alter stage, and functions without any aggregations are supported for XQL queries that define a BIOC" - Ref link

So what are my options here? can i create "Correlation rules"? 

Plan is to go down the "Correlation rules" path, but as per definition

Correlation Rules help you analyze correlations of multi-events from multiple sources by using the Cortex Query Language (XQL) - Ref link


does it really need to be "multiple source" (mine is multi event from same source) ? Is there any gottcha I need to consider? 


If any body been on similar situation, any thoughts guidance and help will be really appreciated 🙂  

[nsinghvirk]

Hello @AshokBabu ,

Thanks for reaching out on Live Community!

Yes, you can create a correlation rule in order to generate alert for your use case. You can use custom dataset/lookup. It need not to be multi source in order for the correlation rule to work.

Below are some points to remember when writing correlation rule.

1. The XQL features for transaction, call, top, and wildcards in datasets (dataset in (<dataset prefix>_*)) are not currently supported in Correlation Rules. If you add them to the XQL definition, you will not be able to Create or Save the Correlation Rule.

2. Using the current_time() function in your XQL query for a correlation rule can yield unexpected results when there are lags or during downtime. This happens if the correlation rule doesn’t run exactly at the time of the data inside the timeframe, for example when a rule is dependent on another rule, or when a rule is stuck due to an error, and then runs in recovery mode. Instead, we recommend using the time_frame_end() function, which returns the timestamp at the end of the time frame in which the rule is executed.