首頁 探索 說明
登入
tum
/
soc
關註 1
讚好 0
複刻 0
代碼 問題管理 0 合併請求 0 提交歷史 34 版本發佈 0 Wiki
瀏覽代碼

progress

Tum 2 天之前
父節點
2b7db93999
當前提交
74f548bfba
共有 2 個文件被更改，包括 39 次插入 和 51 次删除
統一視圖 顯示文件統計
  1. 9 17
      progress-update.md
  2. 30 34
      summary_rule_match.md

+ 9 - 17
progress-update.md
查看文件

713 
 ### 8) Rule Match Evidence (Live Data, 2026-03-14 → 2026-03-17)
 713 
 ### 8) Rule Match Evidence (Live Data, 2026-03-14 → 2026-03-17)
714
714
715 
 - Queried all SOC custom rules against OpenSearch `wazuh-alerts-*` and generated `summary_rule_match.md`
 715 
 - Queried all SOC custom rules against OpenSearch `wazuh-alerts-*` and generated `summary_rule_match.md`
716 
-- Total events matched: **252,262** across 49 implemented rules
716 
+- Total events matched today (2026-03-17): **286,931** across 49 implemented rules
717
717
718 
-Active rules with events:
718 
+Active rules with events (2026-03-17):
719
719
720 
 | Rule | Description | Events |
 720 
 | Rule | Description | Events |
721 
 |------|-------------|--------|
 721 
 |------|-------------|--------|
722 
-| 110301 | A1-01 DNS query to malicious domain | 32 |
723 
-| 110302 | A1-02 DNS IOC domain match | 32 |
724 
-| 110312 | A2-02 FortiGate admin password changed | 32 |
725 
-| 110313 | A2-03 FortiGate new admin account created | 32 |
726 
-| 110315 | A2-05 FortiGate config file downloaded | 32 |
727 
-| 110320 | A2-10 FortiGate traffic to known C2 | 32 |
728 
 | 110341 | A4-01 Windows privileged account auth failure | 1 |
 722 
 | 110341 | A4-01 Windows privileged account auth failure | 1 |
729 
-| 110342 | A4-02 Windows service account auth failure | 38 |
730 
-| 110354 | A4-13 Windows DC DSRM password set (4794) | 251,833 ⚠️ |
731 
-| 110359 | A4-19 Windows authentication failure (4625) | 54 |
732 
-| 110411 | B2-01 Log Monitor log loss detected | 16 |
733 
-| 110501 | C1-01 VPN login geo context candidate | 97 |
734 
-| 110502 | C1-01 Impossible travel confirmed | 31 |
735 
-
736 
-- ⚠️ Rule 110354 (DSRM / event 4794 via parent 60105) accounts for 99.8% of event volume — under investigation to confirm parent SID scope
737 
-- Log sources not yet forwarding: FortiGate VPN (A3), VMware (B1), Sysmon/endpoints (B3), Windows 4624 auth success (C2/C3)
723 
+| 110342 | A4-02 Windows service account auth failure | 46 |
724 
+| 110354 | A4-13 Windows DC DSRM password set (4794) | 285,769 ⚠️ |
725 
+| 110359 | A4-19 Windows authentication failure (4625) | 55 |
726 
+
727 
+- ⚠️ Rule 110354 (DSRM / event 4794 via parent 60103) accounts for 99.6% of event volume — under investigation to confirm parent SID scope
728 
+- A1, A2, B2, C1 rules that fired on earlier dates (Mar 14–16) had 0 events today — likely simulator runs that have since stopped
729 
+- Log sources not yet forwarding: FortiGate syslog (A1/A2), FortiGate VPN (A3), VMware (B1), Sysmon/endpoints (B3), Windows 4624 auth success (C2/C3)
738
730
739 
 ### 9) Tooling and Documentation Updates
 731 
 ### 9) Tooling and Documentation Updates
740
732

+ 30 - 34
summary_rule_match.md
查看文件

1 
 # Wazuh Rule Match Summary — SOC Proposal Appendices A / B / C
 1 
 # Wazuh Rule Match Summary — SOC Proposal Appendices A / B / C
2
2
3 
-**Query window:** 2026-03-14 → 2026-03-17
4 
-**Total events matched across all SOC custom rules:** 252,262
3 
+**Query window:** 2026-03-17 (today only)
4 
+**Total events matched across all SOC custom rules:** 286,931
5 
 **Data source:** OpenSearch index `wazuh-alerts-*` (filter: `rule.groups: soc_prod*`)
 5 
 **Data source:** OpenSearch index `wazuh-alerts-*` (filter: `rule.groups: soc_prod*`)
6
6
7 
 ---
 7 
 ---
12
12
13 
 | Rule ID | Use Case | Description | MITRE | Events |
 13 
 | Rule ID | Use Case | Description | MITRE | Events |
14 
 |---------|----------|-------------|-------|--------|
 14 
 |---------|----------|-------------|-------|--------|
15 
-| 110301 | A1-01 | DNS query to malicious domain (IOC traffic indicator) | T1071.004 | **32** |
16 
-| 110302 | A1-02 | DNS IOC domain match from threat intelligence feed | T1568 | **32** |
15 
+| 110301 | A1-01 | DNS query to malicious domain (IOC traffic indicator) | T1071.004 | 0 |
16 
+| 110302 | A1-02 | DNS IOC domain match from threat intelligence feed | T1568 | 0 |
17
17
18 
 ---
 18 
 ---
19
19
22 
 | Rule ID | Use Case | Description | MITRE | Events |
 22 
 | Rule ID | Use Case | Description | MITRE | Events |
23 
 |---------|----------|-------------|-------|--------|
 23 
 |---------|----------|-------------|-------|--------|
24 
 | 110311 | A2-01 | FortiGate: RDP (3389) traffic allowed | T1021.001 | 0 |
 24 
 | 110311 | A2-01 | FortiGate: RDP (3389) traffic allowed | T1021.001 | 0 |
25 
-| 110312 | A2-02 | FortiGate: admin account password changed | T1098 | **32** |
26 
-| 110313 | A2-03 | FortiGate: new admin account created | T1136 | **32** |
25 
+| 110312 | A2-02 | FortiGate: admin account password changed | T1098 | 0 |
26 
+| 110313 | A2-03 | FortiGate: new admin account created | T1136 | 0 |
27 
 | 110314 | A2-04 | FortiGate: alerting/notification disabled via config change | T1562 | 0 |
 27 
 | 110314 | A2-04 | FortiGate: alerting/notification disabled via config change | T1562 | 0 |
28 
-| 110315 | A2-05 | FortiGate: firewall configuration file downloaded | T1005 | **32** |
28 
+| 110315 | A2-05 | FortiGate: firewall configuration file downloaded | T1005 | 0 |
29 
 | 110316 | A2-06 | FortiGate IPS: multiple critical signatures triggered | T1595 | 0 |
 29 
 | 110316 | A2-06 | FortiGate IPS: multiple critical signatures triggered | T1595 | 0 |
30 
 | 110317 | A2-07 | FortiGate: TCP port scan from external IP | T1046 | 0 |
 30 
 | 110317 | A2-07 | FortiGate: TCP port scan from external IP | T1046 | 0 |
31 
 | 110318 | A2-08 | FortiGate IPS: IOC-based IP indicator detected | T1071.001 | 0 |
 31 
 | 110318 | A2-08 | FortiGate IPS: IOC-based IP indicator detected | T1071.001 | 0 |
32 
 | 110319 | A2-09 | FortiGate: internal port scan from private source IP | T1046 | 0 |
 32 
 | 110319 | A2-09 | FortiGate: internal port scan from private source IP | T1046 | 0 |
33 
-| 110320 | A2-10 | FortiGate: traffic to known C2/malicious IP allowed | T1071.001 | **32** |
33 
+| 110320 | A2-10 | FortiGate: traffic to known C2/malicious IP allowed | T1071.001 | 0 |
34
34
35 
 ---
 35 
 ---
36
36
44 
 | 110334 | A3-04 | VPN multiple account failures from single source IP | T1110.003 | 0 |
 44 
 | 110334 | A3-04 | VPN multiple account failures from single source IP | T1110.003 | 0 |
45 
 | 110335 | A3-05 | VPN authentication success from outside Thailand | T1078 | 0 |
 45 
 | 110335 | A3-05 | VPN authentication success from outside Thailand | T1078 | 0 |
46
46
47 
-> **Note:** A3 rules require FortiGate VPN syslogs (`if_group=fortigate`) with `action=ssl-login-*` events. No matching events in the query window suggests VPN logs are not yet being forwarded to Wazuh.
47 
+> **Note:** A3 rules require FortiGate VPN syslogs (`if_group=fortigate`) with `action=ssl-login-*` events. No matching events today — VPN logs are not yet being forwarded to Wazuh.
48
48
49 
 ---
 49 
 ---
50
50
53 
 | Rule ID | Use Case | Description | MITRE | Events |
 53 
 | Rule ID | Use Case | Description | MITRE | Events |
54 
 |---------|----------|-------------|-------|--------|
 54 
 |---------|----------|-------------|-------|--------|
55 
 | 110341 | A4-01 | Windows: privileged account name auth failure (4625) | T1110.001 | **1** |
 55 
 | 110341 | A4-01 | Windows: privileged account name auth failure (4625) | T1110.001 | **1** |
56 
-| 110342 | A4-02 | Windows: service account auth failure (4625) | T1110.001 | **38** |
56 
+| 110342 | A4-02 | Windows: service account auth failure (4625) | T1110.001 | **46** |
57 
 | 110343 | A4-03 | Windows AD: adfind enumeration tool executed (4688) | T1087.002 | 0 |
 57 
 | 110343 | A4-03 | Windows AD: adfind enumeration tool executed (4688) | T1087.002 | 0 |
58 
 | 110346 | A4-06 | Windows: remote interactive auth success logon type 10 (4624) | T1021.001, T1078 | 0 |
 58 
 | 110346 | A4-06 | Windows: remote interactive auth success logon type 10 (4624) | T1021.001, T1078 | 0 |
59 
 | 110348 | A4-08 | Windows: NTLM network logon type 3 — pass-the-hash indicator (4624) | T1550.002 | 0 |
 59 
 | 110348 | A4-08 | Windows: NTLM network logon type 3 — pass-the-hash indicator (4624) | T1550.002 | 0 |
61 
 | 110350 | A4-10 | Windows: service account interactive logon type 2 (4624) | T1078.003 | 0 |
 61 
 | 110350 | A4-10 | Windows: service account interactive logon type 2 (4624) | T1078.003 | 0 |
62 
 | 110352 | A4-12 | Windows: account added to privileged domain group (4728) | T1098.007 | 0 |
 62 
 | 110352 | A4-12 | Windows: account added to privileged domain group (4728) | T1098.007 | 0 |
63 
 | 110353 | A4-11 | Windows: account added to privileged local group (4732) | T1098.007 | 0 |
 63 
 | 110353 | A4-11 | Windows: account added to privileged local group (4732) | T1098.007 | 0 |
64 
-| 110354 | A4-13 | Windows DC: DSRM account password set (4794) | T1098 | **251,833** ⚠️ |
65 
-| 110359 | A4-19 | Windows: authentication failure (4625) | T1110.003 | **54** |
64 
+| 110354 | A4-13 | Windows DC: DSRM account password set (4794) | T1098 | **285,769** ⚠️ |
65 
+| 110359 | A4-19 | Windows: authentication failure (4625) | T1110.003 | **55** |
66 
 | 110361 | A4-21/23 | Windows: new user account created (4720) | T1136 | 0 |
 66 
 | 110361 | A4-21/23 | Windows: new user account created (4720) | T1136 | 0 |
67 
 | 110362 | A4-22/24 | Windows: user account re-enabled (4722) | T1078 | 0 |
 67 
 | 110362 | A4-22/24 | Windows: user account re-enabled (4722) | T1078 | 0 |
68
68
69 
-> ⚠️ **Rule 110354** (DSRM password set / event 4794) accounts for 251,833 of all matched events — **99.8% of total volume**. The parent rule `60103` fires on Windows Event ID 4794. The extremely high count over 3 days warrants investigation: confirm whether these are genuine events or if the parent SID 60103 matches a broader event set than intended.
69 
+> ⚠️ **Rule 110354** (DSRM password set / event 4794) accounts for 285,769 of all events today — **99.6% of total volume**. The parent rule is `60103` which fires on Windows Event ID 4794. The extremely high count warrants investigation: confirm whether these are genuine DSRM events or if the parent SID 60103 is matching a broader event set than intended.
70
70
71 
 > **Note:** A4-04, A4-05, A4-07, A4-14 through A4-18, A4-20 have no production rules implemented.
 71 
 > **Note:** A4-04, A4-05, A4-07, A4-14 through A4-18, A4-20 have no production rules implemented.
72
72
82 
 | 110402 | B1-02 | ESXi: SSH service enabled on host | T1021.004 | 0 |
 82 
 | 110402 | B1-02 | ESXi: SSH service enabled on host | T1021.004 | 0 |
83 
 | 110403 | B1-03 | ESXi: SSH authentication event detected | T1021.004 | 0 |
 83 
 | 110403 | B1-03 | ESXi: SSH authentication event detected | T1021.004 | 0 |
84
84
85 
-> **Note:** B1 rules require VMware syslog (`if_group=vmware`). No matching events suggests VMware logs are not yet forwarded.
85 
+> **Note:** B1 rules require VMware syslog (`if_group=vmware`). No matching events — VMware logs are not yet forwarded.
86
86
87 
 ---
 87 
 ---
88
88
90
90
91 
 | Rule ID | Use Case | Description | MITRE | Events |
 91 
 | Rule ID | Use Case | Description | MITRE | Events |
92 
 |---------|----------|-------------|-------|--------|
 92 
 |---------|----------|-------------|-------|--------|
93 
-| 110411 | B2-01 | Log Monitor: log ingestion loss detected on monitored stream | T1562.006 | **16** |
93 
+| 110411 | B2-01 | Log Monitor: log ingestion loss detected on monitored stream | T1562.006 | 0 |
94
94
95 
 ---
 95 
 ---
96
96
105 
 | 110425 | B3-05 | Sysmon: LSASS dump via Task Manager (event 10) | T1003.001 | 0 |
 105 
 | 110425 | B3-05 | Sysmon: LSASS dump via Task Manager (event 10) | T1003.001 | 0 |
106 
 | 110426 | B3-06 | Sysmon: certutil.exe execution detected (event 1) | T1105 | 0 |
 106 
 | 110426 | B3-06 | Sysmon: certutil.exe execution detected (event 1) | T1105 | 0 |
107
107
108 
-> **Note:** B3 rules require Windows Sysmon agent installed on endpoints and event forwarding via Wazuh agent. No matching events suggests Sysmon is not yet deployed.
108 
+> **Note:** B3 rules require Windows Sysmon agent deployed on endpoints. No matching events today.
109
109
110 
 ---
 110 
 ---
111
111
115
115
116 
 | Rule ID | Use Case | Description | MITRE | Events |
 116 
 | Rule ID | Use Case | Description | MITRE | Events |
117 
 |---------|----------|-------------|-------|--------|
 117 
 |---------|----------|-------------|-------|--------|
118 
-| 110501 | C1-01 | VPN login success with geo context — impossible travel candidate | T1078 | **97** |
119 
-| 110502 | C1-01 | Impossible travel confirmed by soc-integrator correlation | T1078 | **31** |
120 
-
121 
-> Rule 110501 collects VPN login candidates; 110502 fires when soc-integrator confirms the impossible travel pattern. 31 confirmed impossible travel events were generated over the window.
118 
+| 110501 | C1-01 | VPN login success with geo context — impossible travel candidate | T1078 | 0 |
119 
+| 110502 | C1-01 | Impossible travel confirmed by soc-integrator correlation | T1078 | 0 |
122
120
123 
 ---
 121 
 ---
124
122
141 
 | 110522 | C3-02 | SMB network logon type 3 (lateral movement indicator) | T1021.002, T1078 | 0 |
 139 
 | 110522 | C3-02 | SMB network logon type 3 (lateral movement indicator) | T1021.002, T1078 | 0 |
142 
 | 110523 | C3-03 | Admin account auth success — lateral movement candidate (4624) | T1021.001, T1078.002 | 0 |
 140 
 | 110523 | C3-03 | Admin account auth success — lateral movement candidate (4624) | T1021.001, T1078.002 | 0 |
143
141
144 
-> **Note:** C3-04 (WFP event 5156) has no production rule implemented — skipped to avoid rule-tree explosion from a generic Windows parent.
145 
-
146 
 ---
 142 
 ---
147
143
148 
 ## Summary
 144 
 ## Summary
149
145
150 
 | Appendix | Section | Rules Implemented | Rules with Events | Total Events |
 146 
 | Appendix | Section | Rules Implemented | Rules with Events | Total Events |
151 
 |----------|---------|:-----------------:|:-----------------:|:------------:|
 147 
 |----------|---------|:-----------------:|:-----------------:|:------------:|
152 
-| A | A1 — DNS/IOC | 2 | 2 | 64 |
153 
-| A | A2 — FortiGate FW/IPS | 10 | 4 | 128 |
148 
+| A | A1 — DNS/IOC | 2 | 0 | 0 |
149 
+| A | A2 — FortiGate FW/IPS | 10 | 0 | 0 |
154 
 | A | A3 — FortiGate VPN | 5 | 0 | 0 |
 150 
 | A | A3 — FortiGate VPN | 5 | 0 | 0 |
155 
-| A | A4 — Windows/AD | 13 | 4 | 251,926 |
151 
+| A | A4 — Windows/AD | 13 | 3 | 285,816 |
156 
 | B | B1 — VMware | 3 | 0 | 0 |
 152 
 | B | B1 — VMware | 3 | 0 | 0 |
157 
-| B | B2 — Log Monitor | 1 | 1 | 16 |
153 
+| B | B2 — Log Monitor | 1 | 0 | 0 |
158 
 | B | B3 — Sysmon | 6 | 0 | 0 |
 154 
 | B | B3 — Sysmon | 6 | 0 | 0 |
159 
-| C | C1 — Impossible Travel | 2 | 2 | 128 |
155 
+| C | C1 — Impossible Travel | 2 | 0 | 0 |
160 
 | C | C2 — Credential Abuse | 4 | 0 | 0 |
 156 
 | C | C2 — Credential Abuse | 4 | 0 | 0 |
161 
 | C | C3 — Lateral Movement | 3 | 0 | 0 |
 157 
 | C | C3 — Lateral Movement | 3 | 0 | 0 |
162 
-| **Total** | | **49** | **13** | **252,262** |
158 
+| **Total** | | **49** | **3** | **286,931** |
163
159
164 
-### Active log sources
160 
+### Active log sources (today)
165
161
166 
 | Source | Appendix | Status |
 162 
 | Source | Appendix | Status |
167 
 |--------|----------|--------|
 163 
 |--------|----------|--------|
168 
-| DNS / soc-mvp decoder | A1 | ✅ Receiving events |
169 
-| FortiGate firewall syslog | A2 | ✅ Receiving events |
170 
-| FortiGate VPN syslog | A3, C1 | ⚠️ C1 active; A3 no events (VPN action types not seen) |
171 
-| Windows Security Event Log (via Wazuh agent) | A4, C2, C3 | ✅ Partial — auth failures and DSRM events seen |
164 
+| Windows Security Event Log (via Wazuh agent) | A4 | ✅ Active — auth failures (4625) and DSRM events (4794) ingesting |
165 
+| FortiGate firewall syslog | A2 | ❌ No events today (A1/A2 events were on earlier dates) |
166 
+| FortiGate VPN syslog | A3, C1 | ❌ Not forwarding |
167 
+| DNS / soc-mvp decoder | A1 | ❌ No events today |
168 
+| soc-integrator log-loss events | B2 | ❌ No events today |
172 
 | VMware vCenter/ESXi syslog | B1 | ❌ Not forwarding |
 169 
 | VMware vCenter/ESXi syslog | B1 | ❌ Not forwarding |
173 
-| soc-integrator log-loss events | B2 | ✅ Receiving events |
174 
 | Windows Sysmon (via Wazuh agent) | B3 | ❌ Not deployed |
 170 
 | Windows Sysmon (via Wazuh agent) | B3 | ❌ Not deployed |