Skip to content

[ML] Adding V3 modules for Security_Linux and Security_Windows #123274

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 14 commits into from
Closed

[ML] Adding V3 modules for Security_Linux and Security_Windows #123274

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
390d28c
Adding V3 modules
dishadasgupta Jan 18, 2022
ae9c0d5
Updating modules + docs
dishadasgupta Jan 18, 2022
70f2da4
Adding commas lol
dishadasgupta Jan 18, 2022
0fc7ba8
Reordering get_module
dishadasgupta Jan 18, 2022
3bdb2f8
Linting
dishadasgupta Jan 19, 2022
8f35086
Updating module ids
dishadasgupta Jan 19, 2022
70bafa2
Typo fix
dishadasgupta Jan 19, 2022
a53b23b
More linting
dishadasgupta Jan 19, 2022
871334c
Updating descriptions
dishadasgupta Jan 19, 2022
4c82207
Update datafeed_v3_windows_rare_user_type10_remote_login.json
randomuserid Jan 19, 2022
2f27547
descriptions
randomuserid Jan 19, 2022
81c4fb4
descriptions
randomuserid Jan 20, 2022
d239efd
"allow_lazy_open": true
randomuserid Jan 20, 2022
29377d1
memory limits
randomuserid Jan 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux_v3/logo.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"icon": "logoSecurity"
}
176 changes: 176 additions & 0 deletions x-pack/plugins/ml/server/models/data_recognizer/modules/security_linux_v3/manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,176 @@
{
"id": "security_linux_v3",
"title": "Security: Linux v3",
"description": "Contains all shipping ML jobs for Linux host-based threat hunting and detection. Any ECS-compatible Linux events can be used by the jobs.",
"type": "linux data",
"logoFile": "logo.json",
"defaultIndexPattern": "auditbeat-*,logs-*",
"query": {
"bool": {
"should": [
{
"match": {
"host.os.type": {
"query": "linux",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "debian",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "redhat",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "suse",
"operator": "OR"
}
}
}
]
}
},
"jobs": [
{
"id": "v3_linux_anomalous_network_port_activity_ecs",
"file": "v3_linux_anomalous_network_port_activity_ecs.json"
},
{
"id": "v3_linux_network_configuration_discovery",
"file": "v3_linux_network_configuration_discovery.json"
},
{
"id": "v3_linux_network_connection_discovery",
"file": "v3_linux_network_connection_discovery.json"
},
{
"id": "v3_linux_rare_sudo_user",
"file": "v3_linux_rare_sudo_user.json"
},
{
"id": "v3_linux_rare_user_compiler",
"file": "v3_linux_rare_user_compiler.json"
},
{
"id": "v3_linux_system_information_discovery",
"file": "v3_linux_system_information_discovery.json"
},
{
"id": "v3_linux_system_process_discovery",
"file": "v3_linux_system_process_discovery.json"
},
{
"id": "v3_linux_system_user_discovery",
"file": "v3_linux_system_user_discovery.json"
},
{
"id": "v3_linux_anomalous_process_all_hosts_ecs",
"file": "v3_linux_anomalous_process_all_hosts_ecs.json"
},
{
"id": "v3_linux_anomalous_user_name_ecs",
"file": "v3_linux_anomalous_user_name_ecs.json"
},
{
"id": "v3_linux_rare_metadata_process",
"file": "v3_linux_rare_metadata_process.json"
},
{
"id": "v3_linux_rare_metadata_user",
"file": "v3_linux_rare_metadata_user.json"
},
{
"id": "v3_rare_process_by_host_linux_ecs",
"file": "v3_rare_process_by_host_linux_ecs.json"
},
{
"id": "v3_linux_anomalous_network_activity",
"file": "v3_linux_anomalous_network_activity.json"
}
],
"datafeeds": [
{
"id": "datafeed-v3_linux_anomalous_network_port_activity_ecs",
"file": "datafeed_v3_linux_anomalous_network_port_activity_ecs.json",
"job_id": "v3_linux_anomalous_network_port_activity_ecs"
},
{
"id": "datafeed-v3_linux_network_configuration_discovery",
"file": "datafeed_v3_linux_network_configuration_discovery.json",
"job_id": "v3_linux_network_configuration_discovery"
},
{
"id": "datafeed-v3_linux_network_connection_discovery",
"file": "datafeed_v3_linux_network_connection_discovery.json",
"job_id": "v3_linux_network_connection_discovery"
},
{
"id": "datafeed-v3_linux_rare_sudo_user",
"file": "datafeed_v3_linux_rare_sudo_user.json",
"job_id": "v3_linux_rare_sudo_user"
},
{
"id": "datafeed-v3_linux_rare_user_compiler",
"file": "datafeed_v3_linux_rare_user_compiler.json",
"job_id": "v3_linux_rare_user_compiler"
},
{
"id": "datafeed-v3_linux_system_information_discovery",
"file": "datafeed_v3_linux_system_information_discovery.json",
"job_id": "v3_linux_system_information_discovery"
},
{
"id": "datafeed-v3_linux_system_process_discovery",
"file": "datafeed_v3_linux_system_process_discovery.json",
"job_id": "v3_linux_system_process_discovery"
},
{
"id": "datafeed-v3_linux_system_user_discovery",
"file": "datafeed_v3_linux_system_user_discovery.json",
"job_id": "v3_linux_system_user_discovery"
},
{
"id": "datafeed-v3_linux_anomalous_process_all_hosts_ecs",
"file": "datafeed_v3_linux_anomalous_process_all_hosts_ecs.json",
"job_id": "v3_linux_anomalous_process_all_hosts_ecs"
},
{
"id": "datafeed-v3_linux_anomalous_user_name_ecs",
"file": "datafeed_v3_linux_anomalous_user_name_ecs.json",
"job_id": "v3_linux_anomalous_user_name_ecs"
},
{
"id": "datafeed-v3_linux_rare_metadata_process",
"file": "datafeed_v3_linux_rare_metadata_process.json",
"job_id": "v3_linux_rare_metadata_process"
},
{
"id": "datafeed-v3_linux_rare_metadata_user",
"file": "datafeed_v3_linux_rare_metadata_user.json",
"job_id": "v3_linux_rare_metadata_user"
},
{
"id": "datafeed-v3_rare_process_by_host_linux_ecs",
"file": "datafeed_v3_rare_process_by_host_linux_ecs.json",
"job_id": "v3_rare_process_by_host_linux_ecs"
},
{
"id": "datafeed-v3_linux_anomalous_network_activity",
"file": "datafeed_v3_linux_anomalous_network_activity.json",
"job_id": "v3_linux_anomalous_network_activity"
}
]
}
77 changes: 77 additions & 0 deletions ...recognizer/modules/security_linux_v3/ml/datafeed_v3_linux_anomalous_network_activity.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
{
"job_id": "v3_linux_anomalous_network_activity",
"indices": [
"INDEX_PATTERN_NAME"
],
"max_empty_searches": 10,
"query": {
"bool":
{
"filter": [
{"term": {"event.category": "network"}},
{"term": {"event.type": "start"}}
],
"must": [
{
"bool": {
"should": [
{
"match": {
"host.os.type": {
"query": "linux",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "debian",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "redhat",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "suse",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "ubuntu",
"operator": "OR"
}
}
}
]
}
}
],
"must_not": [
{
"bool": {
"should": [
{"term": {"destination.ip": "127.0.0.1"}},
{"term": {"destination.ip": "127.0.0.53"}},
{"term": {"destination.ip": "::"}},
{"term": {"destination.ip": "::1"}},
{"term": {"user.name":"jenkins"}}
]
}
}
]
}
}
}
77 changes: 77 additions & 0 deletions ...r/modules/security_linux_v3/ml/datafeed_v3_linux_anomalous_network_port_activity_ecs.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
{
"job_id": "v3_linux_anomalous_network_port_activity_ecs",
"indices": [
"INDEX_PATTERN_NAME"
],
"max_empty_searches": 10,
"query": {
"bool":
{
"filter": [
{"term": {"event.category": "network"}},
{"term": {"event.type": "start"}}
],
"must": [
{
"bool": {
"should": [
{
"match": {
"host.os.type": {
"query": "linux",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "debian",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "redhat",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "suse",
"operator": "OR"
}
}
},
{
"match": {
"host.os.family": {
"query": "ubuntu",
"operator": "OR"
}
}
}
]
}
}
],
"must_not": [
{
"bool": {
"should": [
{"term": {"destination.ip": "127.0.0.1"}},
{"term": {"destination.ip": "127.0.0.53"}},
{"term": {"destination.ip": "::"}},
{"term": {"destination.ip": "::1"}},
{"term": {"user.name":"jenkins"}}
]
}
}
]
}
}
}
Loading