Revision as of 18:48, 31 January 2025

Uma Rule (regra) é um grupo de testes que podem desencadear uma ação se condições específicas forem atendidas.

Artigos

Everything you need to know about QRadar Rules (for beginners and experts)

(Github) Sigma - Generic Signature Format for SIEM Systems

Exemplos

Rule	Description
Apply Potential Windows Enumeration Detected and when an event matches any of the following BB: Windows Endpoint Events and when the event matches Event ID is any of 4688 and when the event matches Command (custom) any of [whoami or tasklist or system info] and NOT when the source OP is on of the following IP addresses	Comandos que hackers pegam informações em servidores MS Windows
Apply Login After Work Hours and NOT when the event occur between 09:00 AND 17:00 and when an event were detected by on or more of Netgate pfSense and when the event QID is one of the following (11xx) pfSense - Login on console	Login após horário de trabalho
Apply Disk Space Alert and when the event QID is one of the following (38750076) Disk Sentry Disk Usage Exceed Warn Threshold, (38750038) Disk sentry disk usage exceeded threshold	Alerta de Falta de Espaço em Disco
Apply No Events on the last 2 hours and when the event(s) have not beed detected by one or more of Log Source Group for NNN seconds	Log Source sem eventos a 2 horas
Apply Alert about dropped events and when the event QID is one of the following (38750060) Event pipeline dropped events	Alerta sobre eventos descartados	.	.

Exemplo: (Github) Sigma - Curl Download And Execute Combination

(Github) Sigma - Curl Download And Execute Combination

title: Curl Download And Execute Combination
...
selection:
  CommandLine|contains|windash: ' -c '
  CommandLine|contains|all:
    - 'curl '
    - 'http'
    - '-o'
    - '&'
condition: selection

And in IBM QRadar Rule:

Apply Curl Download And Execute Combination
and when an event matches any of the following BB: Windows Endpoint Events
and when the event matches Event ID is any of 4688
and when the event matches Command (custom) contains all of [/c or curl or http or -o or &]

Ver também

@@ Line 42: / Line 42: @@
 Log Source sem eventos a 2 horas
 |-
+|
+Apply '''Alert about dropped events'''</br>
+'''and''' when the event QID is one of the following </br> '''(38750060) Event pipeline dropped events'''
+||
+Alerta sobre eventos descartados
 | . || .
 |}