Skip to content

Smart descriptions for Vectra #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Cyber-Mathoune wants to merge 3 commits into
base: feat/vectra_smart_descriptions
Choose a base branch
from
Open

Smart descriptions for Vectra #19

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e5a364c
feat(vectra): add smart-descriptions
Aug 16, 2021
aac7020
feat(vectra): add smart-descriptions
Aug 16, 2021
7c33356
update Vectra descriptions
Aug 24, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 51 additions & 13 deletions events/smart-descriptions.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,56 @@
{
"vectra cognito detect": [
{
"value": "{observer.ip} detected {vectra.detection.name} : {host.name} ({host.ip})",
"conditions": [{
"field": "vectra.detection.name"
}]
},
{
"value": "{observer.ip} refreshed detection {vectra.detection.last_type} : {host.name} ({host.ip})",
"conditions": [{
"field": "vectra.detection.last_type"
}]
}
],
{
"value": "{observer.ip} detected {vectra.detection.name} : {host.name} ({host.ip})",
Copy link
Collaborator

@gaelmuller gaelmuller Aug 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"value": "{observer.ip} detected {vectra.detection.name} : {host.name} ({host.ip})",
"value": "{observer.ip} detected {vectra.detection.name} on {host.name} ({host.ip})",

"conditions": [{
"field": "vectra.detection.name"
}],
"relationships": [{
"source": "host.ip",
"target": "destination.ip",
"type": "{vectra.detection.name}"
Copy link
Collaborator

@gaelmuller gaelmuller Aug 24, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using a field name / template is not supported for type at the moment. I've opened an issue to support it.

}]
},
{
"value": "{observer.ip} refreshed detection {vectra.detection.last_type} : {host.name} ({host.ip})",
Copy link
Collaborator

@gaelmuller gaelmuller Aug 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"value": "{observer.ip} refreshed detection {vectra.detection.last_type} : {host.name} ({host.ip})",
"value": "{observer.ip} refreshed detection {vectra.detection.last_type} on {host.name} ({host.ip})",

"conditions": [{
"field": "vectra.detection.last_type"
}]
},
{
"value": "[HOST SCORING] {host.name} ({host.ip}) : threat = {vectra.risk_score_norm}",
Copy link
Collaborator

@gaelmuller gaelmuller Aug 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smart Descriptions are supposed to abstract complexity as much as possible. Can't we create a sentence here ?

"conditions": [{
"field": "event.type",
"value": "HOST SCORING"
}],
},
{
"value": "[LOCKDOWN] {user.name} {action.name} {vectra.account.name} ",
Copy link
Collaborator

@gaelmuller gaelmuller Aug 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smart Descriptions are supposed to abstract complexity as much as possible. Can't we create a sentence here ?

"conditions": [{
"field": "event.type",
"value": "LOCKDOWN"
}]
},
{
"value": "[HOST LOCKDOWN] {user.name} {action.name} {host.name} ",
Copy link
Collaborator

@gaelmuller gaelmuller Aug 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smart Descriptions are supposed to abstract complexity as much as possible. Can't we create a sentence here ?

"conditions": [{
"field": "event.type",
"value": "HOST_LOCKDOWN"
}]
},
{
"value": "[CAMPAIGN] event : {vectra.detection.reason} from {source.ip} to {vectra.destination.name} ({destination.ip}) ",
Copy link
Collaborator

@gaelmuller gaelmuller Aug 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Smart Descriptions are supposed to abstract complexity as much as possible. Can't we create a sentence here ?

"conditions": [{
"field": "event.type",
"value": "HOST_LOCKDOWN"
}],
"relationships": [{
"source": "source.ip",
"target": "destination.ip",
"type": "{vectra.detection.reason}"
Copy link
Collaborator

@gaelmuller gaelmuller Aug 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can't use a field name / template as relationship type at the moment

}]
Comment on lines +65 to +69
Copy link
Collaborator

@gaelmuller gaelmuller Aug 30, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"relationships": [{
"source": "source.ip",
"target": "destination.ip",
"type": "campaign"
}]

copy paste error ?

}
],
"retarus email security": [{
"value": "{retarus.sender} sent an e-mail to {retarus.recipient} with status: {retarus.status} (Message-ID: {retarus.message_id})",
"conditions": [{
Expand Down