rare iptable delete command

[Muthuvel]

We received couple of alerts on rare iptable delete command.On checking the host activity, we could able to observe all commands including newly entered command in the host machine but not able to see the iptable delete/flush command in the activity log under Query builder.

[etugriceri]

Hi Muthuvel, 

I think the question is how can we see delete/flush command ?

But event its, still some of the important informations are missing like

What is the alert source? 

did you try to investigate casualty chain? 

did you check action_remote_process_image_command_line or actor_process_command_line fields for parameters? 

is your time line correct when you use Query builder?