Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add restrictive filters for every channel and provider name filter. #403

Merged
merged 4 commits into from
May 17, 2019
Merged

Add restrictive filters for every channel and provider name filter. #403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5d39629
Add more restrictive regex to eventchannel rules
cristgl May 16, 2019
0a4a24c
Fix McAfee, Eventlog rules
cristgl May 16, 2019
e1633aa
Merge branch '3.9' into fix-401
cristgl May 16, 2019
54fa6dd
Fix McAfee variables filter
cristgl May 17, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions rules/0575-win-base_rules.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,56 +23,56 @@
<!-- Classification by channel -->
<rule id="60001" level="0">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Security</field>
<field name="win.system.channel">^Security$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the Security channel</description>
</rule>

<rule id="60002" level="0">
<if_sid>60000</if_sid>
<field name="win.system.channel">^System</field>
<field name="win.system.channel">^System$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the System channel</description>
</rule>

<rule id="60003" level="0">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Application</field>
<field name="win.system.channel">^Application$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the Application channel</description>
</rule>

<rule id="60004" level="0">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Microsoft-Windows-Sysmon/Operational</field>
<field name="win.system.channel">^Microsoft-Windows-Sysmon/Operational$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the Sysmon channel</description>
</rule>

<rule id="60005" level="0">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Microsoft-Windows-Windows Defender/Operational</field>
<field name="win.system.channel">^Microsoft-Windows-Windows Defender/Operational$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the System channel</description>
</rule>

<rule id="60006" level="0">
<if_sid>60000</if_sid>
<field name="win.system.channel">^McLogEvent</field>
<if_sid>60003</if_sid>
<field name="win.system.providerName">^McLogEvent$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the McAfee channel</description>
</rule>

<rule id="60007" level="0">
<if_sid>60001</if_sid>
<field name="win.system.providerName">^Microsoft-Windows-Eventlog</field>
<if_sid>60002</if_sid>
<field name="win.system.providerName">^Eventlog$</field>
<options>no_full_log</options>
<description>Group of rules for Windows Eventlog</description>
</rule>

<rule id="60008" level="0">
<if_sid>60002</if_sid>
<field name="win.system.providerName">^Microsoft Antimalware</field>
<field name="win.system.providerName">^Microsoft Antimalware$</field>
<options>no_full_log</options>
<description>Group of Microsoft Security Essentials rules</description>
</rule>
Expand All @@ -81,30 +81,30 @@

<rule id="60009" level="0">
<if_sid>60000</if_sid>
<field name="win.system.severityValue">^INFORMATION</field>
<field name="win.system.severityValue">^INFORMATION$</field>
<description>Windows informational event</description>
<options>no_full_log</options>
</rule>

<rule id="60010" level="0">
<if_sid>60000</if_sid>
<field name="win.system.severityValue">^WARNING</field>
<field name="win.system.severityValue">^WARNING$</field>
<description>Windows warning event</description>
<options>no_full_log</options>
<group>gpg13_4.12,</group>
</rule>

<rule id="60011" level="5">
<if_sid>60000</if_sid>
<field name="win.system.severityValue">^ERROR</field>
<field name="win.system.severityValue">^ERROR$</field>
<description>Windows error event</description>
<options>no_full_log</options>
<group>system_error,gpg13_4.3,gdpr_IV_35.7.d,</group>
</rule>

<rule id="60012" level="10">
<if_sid>60000</if_sid>
<field name="win.system.severityValue">^CRITICAL</field>
<field name="win.system.severityValue">^CRITICAL$</field>
<description>Windows critical event</description>
<options>no_full_log</options>
<group>system_error,gpg13_4.3,gdpr_IV_35.7.d,</group>
Expand Down
12 changes: 6 additions & 6 deletions rules/0580-win-security_rules.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,37 +12,37 @@

<rule id="60100" level="0">
<if_sid>60001</if_sid>
<field name="win.system.severityValue">^INFORMATION</field>
<field name="win.system.severityValue">^INFORMATION$</field>
<description>Windows Security informational event</description>
<options>no_full_log</options>
</rule>

<rule id="60101" level="0">
<if_sid>60001</if_sid>
<field name="win.system.severityValue">^WARNING</field>
<field name="win.system.severityValue">^WARNING$</field>
<description>Windows Security warning event</description>
<options>no_full_log</options>
<group>gpg13_4.12,</group>
</rule>

<rule id="60102" level="5">
<if_sid>60001</if_sid>
<field name="win.system.severityValue">^ERROR</field>
<field name="win.system.severityValue">^ERROR$</field>
<description>Windows Security error event</description>
<options>no_full_log</options>
<group>system_error,gpg13_4.3,gdpr_IV_35.7.d,</group>
</rule>

<rule id="60103" level="0">
<if_sid>60001</if_sid>
<field name="win.system.severityValue">^AUDIT_SUCCESS|^success</field>
<field name="win.system.severityValue">^AUDIT_SUCCESS$|^success$</field>
<description>Windows audit success event</description>
<options>no_full_log</options>
</rule>

<rule id="60104" level="5">
<if_sid>60001</if_sid>
<field name="win.system.severityValue">^AUDIT_FAILURE|^failure</field>
<field name="win.system.severityValue">^AUDIT_FAILURE$|^failure$</field>
<description>Windows audit failure event</description>
<group>pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
<options>no_full_log</options>
Expand Down Expand Up @@ -512,7 +512,7 @@

<rule id="60161" level="0">
<if_sid>60160,60141</if_sid>
<field name="win.eventdata.subjectAccountName">None</field>
<field name="win.eventdata.subjectAccountName">^None$</field>
<description>Local User Group NONE</description>
<options>no_full_log</options>
<info>Bogus group user added to upon creation</info>
Expand Down
Loading