Cyber Security: Lookups

Contents

• Overview
• General Data Requirements
• Populating Lookups
• Lookup Groups
• Automatically Populated Lookups
• Keeping Lookups Up to Date

---

Overview

Lookups store infrastructure details not present in events. They provide context for rules: which hosts are critical or domain controllers, which accounts are privileged, which networks are internal, and which scanners are authorized.

Important

Lookups are supplied empty, and nearly all module rules use at least one lookup. Until the lookups are populated, rules may not work correctly.

• rules that compare events with lookups (domain controllers, privileged groups, and VIP users) may not trigger or may trigger on legitimate activity
• rules with exclusions (scanners and service accounts) produce recurring false positives
• incidents lack context about host criticality and role, and network segment

Populate lookups before enabling rules. See Rule Enablement Order.

For details about working with lookups in the interface, see Lookup Manager.

---

General Data Requirements

• enter host names (host) in lowercase without the domain, for example dc01, not DC01.corp.local
• enter account names (user) in lowercase without the domain, for example ivanov, not CORP\Ivanov
• IP addresses are matched exactly, not by subnet membership, so 192.168.0.0/16 does not match 192.168.1.10. Enter individual addresses in lookups used by rules to find host addresses

---

Populating Lookups

You can populate a lookup in three ways.

• manually under Main Menu - Lookup Manager - Lookup List: select a module lookup and open it
• by uploading a CSV file
• from external systems through a scheduled job

---

Lookup Groups

Group	Contents
infrastructure	critical hosts, domain controllers, internal networks and segments, hosts with Sysmon
accounts and groups	critical and service accounts, privileged groups, workstation owners, Active Directory information
exclusions	authorized scanners and monitoring systems, legitimate sources and processes
threat indicators	addresses and domains from threat feeds, channel names used by remote management tools
email	internal email domains, VIP users, and mass-mailing exclusions
baselines	populated automatically by service rules

---

Automatically Populated Lookups

Some lookups are populated on a schedule by the module's service rules. They store how long hosts have been observed, processes and privileged logins on hosts, and typical login times and sources for users. Do not populate these lookups manually. Enable the service rules as described in Rule Enablement Order.

---

Keeping Lookups Up to Date

Update lookups whenever the infrastructure changes.

Infrastructure Change	Lookups to Update
adding or removing hosts, changing a host's role	infrastructure lookups
changing network segmentation	network and segment lookups
changing administrative group membership	account and group lookups
adding service accounts	service account and exclusion lookups
adding scanners, monitoring systems, or integrations	exclusion lookups
adding threat indicators	threat indicator lookups

An outdated list of critical hosts or domain controllers does not prevent rules from triggering, but it can understate incident severity and omit context. An outdated exclusion list causes recurring false positives.

Documents Included with the Module

The "Cyber Security Expertise Description" document included with the module lists lookups, their purpose, fields, and data formats, as well as the rules that depend on them.