Skip to main content
Version: 6.2

Cyber Security: Tuning for Your Infrastructure

Contents​

Overview​

Some rules contain values designed for a typical infrastructure.

  • thresholds — minimum number of events, hosts, accounts, or ports in the analysis window
  • exclusions in rule conditions — legitimate processes, accounts, and hosts specific to each organization
  • exclusion lookups — authorized scanners, service accounts, and trusted addresses

Check these values against your infrastructure data before enabling a rule, and review them whenever the infrastructure changes.

Investigation Procedure​

Too Many False Positives​

  1. Check the lookups used by the rule. They must be populated and use the required format (case, short host name, exact address); see Lookups
  2. Determine why the rule triggers. If the cause is a legitimate high-volume process (service polling, a scanner, or a monitoring system), add it to an exclusion lookup or to the exclusions in the rule condition. Recommendations for individual rules are provided in the "Rule Enablement and Tuning Order" document
  3. If the alerts are caused by the general activity level, raise the threshold as described in Threshold Rules
Important

Keep exclusions as narrow as possible, using pairs such as "process and directory", "account and host", or "subject and namespace". Excluding an entire process name or namespace can also hide an attack using the same process or account.

Rule Does Not Trigger​

  1. Verify that source data arrives and contains the fields used by the rule; see Connecting and Configuring Data Collection
  2. Verify that the required events are enabled on the source; see Configuring Infrastructure Sources
  3. Run the rule query in Search without the threshold condition and compare actual values with the threshold; see Testing a Rule in Search
  4. If the threshold is not reached during a real attack or a test scenario, lower it
  1. Open the rule under Main Menu - Job Scheduler - Jobs List and click Open in Search
  2. Copy the rule query to Main Menu - Search
  3. Remove the threshold where stage after the aggregation (aggs)
  4. Set a period longer than the rule window, for example 7 days, to see typical values
  5. Assess how the aggregated value varies over time
  6. Set the threshold above the normal maximum with a margin. If attack and normal activity values overlap, add an exclusion instead of raising the threshold

Changing a Rule​

  • change thresholds and exclusions in the rule query under Main Menu - Job Scheduler - Jobs List
  • after changing the rule, test the query in Search using the rule's analysis window

Threshold Rules​

Raise the threshold if normal activity regularly exceeds it. Lower it if a test scenario does not reach it.

Rule TypeWhen to Raise the ThresholdWhen to Lower the Threshold
password brute-force and sprayingservices with many repeated login attempts (outdated service passwords, mobile email clients)account lockout policy takes effect before the threshold is reached
port and host scanninginventory, monitoring, and backup systems (prefer address-based exclusions)a small network where an attacker needs only a few hosts
logging in to many hostsadministrators, configuration management systems, and jump servers (prefer account-based exclusions)a small infrastructure where an attacker needs only a few hosts
bulk requests to a web serveravailability monitoring, search crawlers, and load testing (prefer address-based exclusions in the scanner lookup)low-traffic sites
DNSservers with many distinct DNS names (proxies, mail servers)depending on infrastructure characteristics
Documents Included with the Module

The "Rule Enablement and Tuning Order" document included with the module provides default thresholds for each rule, rule-specific exclusion recommendations with examples, and a list of rules that depend on lookups.