Accueil Explorer Aide
Connexion
tum
/
soc
Suivre 1
Voter 0
Fork 0
Code Tickets 0 Pull Requests 0 Commits 34 Publications 0 Wiki
Parcourir la Source

progress

Tum il y a 2 jours
Parent
2b7db93999
commit
74f548bfba
2 fichiers modifiés avec 39 ajouts et 51 suppressions
Vue séparée Afficher les stats Diff
  1. 9 17
      progress-update.md
  2. 30 34
      summary_rule_match.md

+ 9 - 17
progress-update.md
Voir le fichier 

@@ -713,28 +713,20 @@ Project: FoodProject SOC Platform (Wazuh + Shuffle + IRIS-web + SOC Integrator)
713 713 
 ### 8) Rule Match Evidence (Live Data, 2026-03-14 → 2026-03-17)
714 714
715 715 
 - Queried all SOC custom rules against OpenSearch `wazuh-alerts-*` and generated `summary_rule_match.md`
716 
-- Total events matched: **252,262** across 49 implemented rules
716 
+- Total events matched today (2026-03-17): **286,931** across 49 implemented rules
717 717
718 
-Active rules with events:
718 
+Active rules with events (2026-03-17):
719 719
720 720 
 | Rule | Description | Events |
721 721 
 |------|-------------|--------|
722 
-| 110301 | A1-01 DNS query to malicious domain | 32 |
723 
-| 110302 | A1-02 DNS IOC domain match | 32 |
724 
-| 110312 | A2-02 FortiGate admin password changed | 32 |
725 
-| 110313 | A2-03 FortiGate new admin account created | 32 |
726 
-| 110315 | A2-05 FortiGate config file downloaded | 32 |
727 
-| 110320 | A2-10 FortiGate traffic to known C2 | 32 |
728 722 
 | 110341 | A4-01 Windows privileged account auth failure | 1 |
729 
-| 110342 | A4-02 Windows service account auth failure | 38 |
730 
-| 110354 | A4-13 Windows DC DSRM password set (4794) | 251,833 ⚠️ |
731 
-| 110359 | A4-19 Windows authentication failure (4625) | 54 |
732 
-| 110411 | B2-01 Log Monitor log loss detected | 16 |
733 
-| 110501 | C1-01 VPN login geo context candidate | 97 |
734 
-| 110502 | C1-01 Impossible travel confirmed | 31 |
735 
-
736 
-- ⚠️ Rule 110354 (DSRM / event 4794 via parent 60105) accounts for 99.8% of event volume — under investigation to confirm parent SID scope
737 
-- Log sources not yet forwarding: FortiGate VPN (A3), VMware (B1), Sysmon/endpoints (B3), Windows 4624 auth success (C2/C3)
723 
+| 110342 | A4-02 Windows service account auth failure | 46 |
724 
+| 110354 | A4-13 Windows DC DSRM password set (4794) | 285,769 ⚠️ |
725 
+| 110359 | A4-19 Windows authentication failure (4625) | 55 |
726 
+
727 
+- ⚠️ Rule 110354 (DSRM / event 4794 via parent 60103) accounts for 99.6% of event volume — under investigation to confirm parent SID scope
728 
+- A1, A2, B2, C1 rules that fired on earlier dates (Mar 14–16) had 0 events today — likely simulator runs that have since stopped
729 
+- Log sources not yet forwarding: FortiGate syslog (A1/A2), FortiGate VPN (A3), VMware (B1), Sysmon/endpoints (B3), Windows 4624 auth success (C2/C3)
738 730
739 731 
 ### 9) Tooling and Documentation Updates
740 732

+ 30 - 34
summary_rule_match.md
Voir le fichier 

@@ -1,7 +1,7 @@
1 1 
 # Wazuh Rule Match Summary — SOC Proposal Appendices A / B / C
2 2
3 
-**Query window:** 2026-03-14 → 2026-03-17
4 
-**Total events matched across all SOC custom rules:** 252,262
3 
+**Query window:** 2026-03-17 (today only)
4 
+**Total events matched across all SOC custom rules:** 286,931
5 5 
 **Data source:** OpenSearch index `wazuh-alerts-*` (filter: `rule.groups: soc_prod*`)
6 6
7 7 
 ---
 
@@ -12,8 +12,8 @@
12 12
13 13 
 | Rule ID | Use Case | Description | MITRE | Events |
14 14 
 |---------|----------|-------------|-------|--------|
15 
-| 110301 | A1-01 | DNS query to malicious domain (IOC traffic indicator) | T1071.004 | **32** |
16 
-| 110302 | A1-02 | DNS IOC domain match from threat intelligence feed | T1568 | **32** |
15 
+| 110301 | A1-01 | DNS query to malicious domain (IOC traffic indicator) | T1071.004 | 0 |
16 
+| 110302 | A1-02 | DNS IOC domain match from threat intelligence feed | T1568 | 0 |
17 17
18 18 
 ---
19 19 
 
@@ -22,15 +22,15 @@
22 22 
 | Rule ID | Use Case | Description | MITRE | Events |
23 23 
 |---------|----------|-------------|-------|--------|
24 24 
 | 110311 | A2-01 | FortiGate: RDP (3389) traffic allowed | T1021.001 | 0 |
25 
-| 110312 | A2-02 | FortiGate: admin account password changed | T1098 | **32** |
26 
-| 110313 | A2-03 | FortiGate: new admin account created | T1136 | **32** |
25 
+| 110312 | A2-02 | FortiGate: admin account password changed | T1098 | 0 |
26 
+| 110313 | A2-03 | FortiGate: new admin account created | T1136 | 0 |
27 27 
 | 110314 | A2-04 | FortiGate: alerting/notification disabled via config change | T1562 | 0 |
28 
-| 110315 | A2-05 | FortiGate: firewall configuration file downloaded | T1005 | **32** |
28 
+| 110315 | A2-05 | FortiGate: firewall configuration file downloaded | T1005 | 0 |
29 29 
 | 110316 | A2-06 | FortiGate IPS: multiple critical signatures triggered | T1595 | 0 |
30 30 
 | 110317 | A2-07 | FortiGate: TCP port scan from external IP | T1046 | 0 |
31 31 
 | 110318 | A2-08 | FortiGate IPS: IOC-based IP indicator detected | T1071.001 | 0 |
32 32 
 | 110319 | A2-09 | FortiGate: internal port scan from private source IP | T1046 | 0 |
33 
-| 110320 | A2-10 | FortiGate: traffic to known C2/malicious IP allowed | T1071.001 | **32** |
33 
+| 110320 | A2-10 | FortiGate: traffic to known C2/malicious IP allowed | T1071.001 | 0 |
34 34
35 35 
 ---
36 36 
 
@@ -44,7 +44,7 @@
44 44 
 | 110334 | A3-04 | VPN multiple account failures from single source IP | T1110.003 | 0 |
45 45 
 | 110335 | A3-05 | VPN authentication success from outside Thailand | T1078 | 0 |
46 46
47 
-> **Note:** A3 rules require FortiGate VPN syslogs (`if_group=fortigate`) with `action=ssl-login-*` events. No matching events in the query window suggests VPN logs are not yet being forwarded to Wazuh.
47 
+> **Note:** A3 rules require FortiGate VPN syslogs (`if_group=fortigate`) with `action=ssl-login-*` events. No matching events today — VPN logs are not yet being forwarded to Wazuh.
48 48
49 49 
 ---
50 50 
 
@@ -53,7 +53,7 @@
53 53 
 | Rule ID | Use Case | Description | MITRE | Events |
54 54 
 |---------|----------|-------------|-------|--------|
55 55 
 | 110341 | A4-01 | Windows: privileged account name auth failure (4625) | T1110.001 | **1** |
56 
-| 110342 | A4-02 | Windows: service account auth failure (4625) | T1110.001 | **38** |
56 
+| 110342 | A4-02 | Windows: service account auth failure (4625) | T1110.001 | **46** |
57 57 
 | 110343 | A4-03 | Windows AD: adfind enumeration tool executed (4688) | T1087.002 | 0 |
58 58 
 | 110346 | A4-06 | Windows: remote interactive auth success logon type 10 (4624) | T1021.001, T1078 | 0 |
59 59 
 | 110348 | A4-08 | Windows: NTLM network logon type 3 — pass-the-hash indicator (4624) | T1550.002 | 0 |
 
@@ -61,12 +61,12 @@
61 61 
 | 110350 | A4-10 | Windows: service account interactive logon type 2 (4624) | T1078.003 | 0 |
62 62 
 | 110352 | A4-12 | Windows: account added to privileged domain group (4728) | T1098.007 | 0 |
63 63 
 | 110353 | A4-11 | Windows: account added to privileged local group (4732) | T1098.007 | 0 |
64 
-| 110354 | A4-13 | Windows DC: DSRM account password set (4794) | T1098 | **251,833** ⚠️ |
65 
-| 110359 | A4-19 | Windows: authentication failure (4625) | T1110.003 | **54** |
64 
+| 110354 | A4-13 | Windows DC: DSRM account password set (4794) | T1098 | **285,769** ⚠️ |
65 
+| 110359 | A4-19 | Windows: authentication failure (4625) | T1110.003 | **55** |
66 66 
 | 110361 | A4-21/23 | Windows: new user account created (4720) | T1136 | 0 |
67 67 
 | 110362 | A4-22/24 | Windows: user account re-enabled (4722) | T1078 | 0 |
68 68
69 
-> ⚠️ **Rule 110354** (DSRM password set / event 4794) accounts for 251,833 of all matched events — **99.8% of total volume**. The parent rule `60103` fires on Windows Event ID 4794. The extremely high count over 3 days warrants investigation: confirm whether these are genuine events or if the parent SID 60103 matches a broader event set than intended.
69 
+> ⚠️ **Rule 110354** (DSRM password set / event 4794) accounts for 285,769 of all events today — **99.6% of total volume**. The parent rule is `60103` which fires on Windows Event ID 4794. The extremely high count warrants investigation: confirm whether these are genuine DSRM events or if the parent SID 60103 is matching a broader event set than intended.
70 70
71 71 
 > **Note:** A4-04, A4-05, A4-07, A4-14 through A4-18, A4-20 have no production rules implemented.
72 72 
 
@@ -82,7 +82,7 @@
82 82 
 | 110402 | B1-02 | ESXi: SSH service enabled on host | T1021.004 | 0 |
83 83 
 | 110403 | B1-03 | ESXi: SSH authentication event detected | T1021.004 | 0 |
84 84
85 
-> **Note:** B1 rules require VMware syslog (`if_group=vmware`). No matching events suggests VMware logs are not yet forwarded.
85 
+> **Note:** B1 rules require VMware syslog (`if_group=vmware`). No matching events — VMware logs are not yet forwarded.
86 86
87 87 
 ---
88 88 
 
@@ -90,7 +90,7 @@
90 90
91 91 
 | Rule ID | Use Case | Description | MITRE | Events |
92 92 
 |---------|----------|-------------|-------|--------|
93 
-| 110411 | B2-01 | Log Monitor: log ingestion loss detected on monitored stream | T1562.006 | **16** |
93 
+| 110411 | B2-01 | Log Monitor: log ingestion loss detected on monitored stream | T1562.006 | 0 |
94 94
95 95 
 ---
96 96 
 
@@ -105,7 +105,7 @@
105 105 
 | 110425 | B3-05 | Sysmon: LSASS dump via Task Manager (event 10) | T1003.001 | 0 |
106 106 
 | 110426 | B3-06 | Sysmon: certutil.exe execution detected (event 1) | T1105 | 0 |
107 107
108 
-> **Note:** B3 rules require Windows Sysmon agent installed on endpoints and event forwarding via Wazuh agent. No matching events suggests Sysmon is not yet deployed.
108 
+> **Note:** B3 rules require Windows Sysmon agent deployed on endpoints. No matching events today.
109 109
110 110 
 ---
111 111 
 
@@ -115,10 +115,8 @@
115 115
116 116 
 | Rule ID | Use Case | Description | MITRE | Events |
117 117 
 |---------|----------|-------------|-------|--------|
118 
-| 110501 | C1-01 | VPN login success with geo context — impossible travel candidate | T1078 | **97** |
119 
-| 110502 | C1-01 | Impossible travel confirmed by soc-integrator correlation | T1078 | **31** |
120 
-
121 
-> Rule 110501 collects VPN login candidates; 110502 fires when soc-integrator confirms the impossible travel pattern. 31 confirmed impossible travel events were generated over the window.
118 
+| 110501 | C1-01 | VPN login success with geo context — impossible travel candidate | T1078 | 0 |
119 
+| 110502 | C1-01 | Impossible travel confirmed by soc-integrator correlation | T1078 | 0 |
122 120
123 121 
 ---
124 122 
 
@@ -141,34 +139,32 @@
141 139 
 | 110522 | C3-02 | SMB network logon type 3 (lateral movement indicator) | T1021.002, T1078 | 0 |
142 140 
 | 110523 | C3-03 | Admin account auth success — lateral movement candidate (4624) | T1021.001, T1078.002 | 0 |
143 141
144 
-> **Note:** C3-04 (WFP event 5156) has no production rule implemented — skipped to avoid rule-tree explosion from a generic Windows parent.
145 
-
146 142 
 ---
147 143
148 144 
 ## Summary
149 145
150 146 
 | Appendix | Section | Rules Implemented | Rules with Events | Total Events |
151 147 
 |----------|---------|:-----------------:|:-----------------:|:------------:|
152 
-| A | A1 — DNS/IOC | 2 | 2 | 64 |
153 
-| A | A2 — FortiGate FW/IPS | 10 | 4 | 128 |
148 
+| A | A1 — DNS/IOC | 2 | 0 | 0 |
149 
+| A | A2 — FortiGate FW/IPS | 10 | 0 | 0 |
154 150 
 | A | A3 — FortiGate VPN | 5 | 0 | 0 |
155 
-| A | A4 — Windows/AD | 13 | 4 | 251,926 |
151 
+| A | A4 — Windows/AD | 13 | 3 | 285,816 |
156 152 
 | B | B1 — VMware | 3 | 0 | 0 |
157 
-| B | B2 — Log Monitor | 1 | 1 | 16 |
153 
+| B | B2 — Log Monitor | 1 | 0 | 0 |
158 154 
 | B | B3 — Sysmon | 6 | 0 | 0 |
159 
-| C | C1 — Impossible Travel | 2 | 2 | 128 |
155 
+| C | C1 — Impossible Travel | 2 | 0 | 0 |
160 156 
 | C | C2 — Credential Abuse | 4 | 0 | 0 |
161 157 
 | C | C3 — Lateral Movement | 3 | 0 | 0 |
162 
-| **Total** | | **49** | **13** | **252,262** |
158 
+| **Total** | | **49** | **3** | **286,931** |
163 159
164 
-### Active log sources
160 
+### Active log sources (today)
165 161
166 162 
 | Source | Appendix | Status |
167 163 
 |--------|----------|--------|
168 
-| DNS / soc-mvp decoder | A1 | ✅ Receiving events |
169 
-| FortiGate firewall syslog | A2 | ✅ Receiving events |
170 
-| FortiGate VPN syslog | A3, C1 | ⚠️ C1 active; A3 no events (VPN action types not seen) |
171 
-| Windows Security Event Log (via Wazuh agent) | A4, C2, C3 | ✅ Partial — auth failures and DSRM events seen |
164 
+| Windows Security Event Log (via Wazuh agent) | A4 | ✅ Active — auth failures (4625) and DSRM events (4794) ingesting |
165 
+| FortiGate firewall syslog | A2 | ❌ No events today (A1/A2 events were on earlier dates) |
166 
+| FortiGate VPN syslog | A3, C1 | ❌ Not forwarding |
167 
+| DNS / soc-mvp decoder | A1 | ❌ No events today |
168 
+| soc-integrator log-loss events | B2 | ❌ No events today |
172 169 
 | VMware vCenter/ESXi syslog | B1 | ❌ Not forwarding |
173 
-| soc-integrator log-loss events | B2 | ✅ Receiving events |
174 170 
 | Windows Sysmon (via Wazuh agent) | B3 | ❌ Not deployed |