diff --git a/docs/cse/rules/normalized-threat-rules.md b/docs/cse/rules/normalized-threat-rules.md index 5324b82dfb2..a2e967b789a 100644 --- a/docs/cse/rules/normalized-threat-rules.md +++ b/docs/cse/rules/normalized-threat-rules.md @@ -30,7 +30,7 @@ For example, a normalized threat rule that looks for intrusions would work with * IPS/IDS Appliances * Microsoft Graph Security API -Ordinarily, rules define the log messages they’ll be applied to by specifying `metadata_vendor` and `metadata_product `in the rule expression. A normalized rule doesn’t specify these attributes. Instead, it looks at another attribute that is set during the log mapping process: `threat_ruleType`. In the log mapping process for a message type, the value of `threat_ruleType` is set  to a value that corresponds to a threat type, for example “intrusion”. Then, normalized threat rules can look for messages whose `threat_ruleType` field is “intrusion”, regardless of vendor or product. For information about mapping requirements for messages that describe security events, see [Field Mapping for Security Event Sources](/docs/cse/schema/field-mapping-security-event-sources). +Ordinarily, rules define the log messages they’ll be applied to by specifying `metadata_vendor` and `metadata_product `in the rule expression. A normalized rule doesn’t specify these attributes. Instead, it looks at another attribute that is set during the log mapping process: `threat_ruleType`. In the log mapping process for a message type, the value of `threat_ruleType` is set  to a value that corresponds to a threat type, for example “intrusion”. Then, normalized threat rules can look for messages whose `threat_ruleType` field is “intrusion”, regardless of vendor or product. For the full list of values, see [Types of normalized threat rules](#types-of-normalized-threat-rules). For information about mapping requirements for messages that describe security events, see [Field Mapping for Security Event Sources](/docs/cse/schema/field-mapping-security-event-sources). ## Types of normalized threat rules  @@ -90,15 +90,180 @@ Cloud SIEM provides the following normalized malware rules: For messages that indicate suspicious or malicious activity based on behavior, rather than a signature. These messages don’t usually include a signature, instead might contain the command line arguments and other actions taken by the adversary. -Log sources that issue behavior-related messages include: +Behavior-based detections are divided among the six more specific types described below. The `direct` type is retained for out-of-the-box mappings from generic sources that can't be assigned to a single type, such as the Microsoft Graph Security API catch-all mappings, and for your own log mappings that set `threat_ruleType` to `direct`. + +Log sources that remain mapped to `direct` include: + +* Microsoft Graph Security API catch-all mappings +* Microsoft 365 Defender +* Microsoft Azure Advanced Threat Protection (standalone mapping) +* Exabeam +* Qualys + +Cloud SIEM provides the following normalized direct rule: + +* [Normalized Security Signal](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S00402.md) - Passes through an alert from a security product and adjusts the severity accordingly based on the severity provided in the log. + +### endpoint + +For messages from host-based security agents that detect suspicious or malicious behavior on an endpoint, such as EDR and EPP detections. Out-of-the-box mappings for these sources haven't migrated yet. Until they do, these sources set `threat_ruleType` to `direct`. See [Behavior-based log mapping migration](#behavior-based-log-mapping-migration). + +Log sources that issue endpoint-related messages include: * CrowdStrike Falcon -* Symantec Endpoint Protection EDR -* Carbon Black Response +* SentinelOne +* Carbon Black +* Palo Alto Cortex XDR +* Windows Defender and Azure Defender for Endpoint +* Sophos +* Trend Micro +* McAfee +* Cylance +* Cisco AMP +* Cybereason +* Endgame +* Jamf Protect +* Malwarebytes +* Tanium +* FireEye HX +* Bitdefender +* Google Workspace + +Cloud SIEM provides the following normalized endpoint rule: + +* [Normalized Endpoint Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01158.md) - Passes through an alert from a host-based security agent and adjusts the severity accordingly based on the severity provided in the log. + +### runtime + +For messages from workload security agents that detect suspicious or malicious behavior in containers and other cloud-native runtimes. + +Log sources that issue runtime-related messages include: + +* Falco +* Sysdig Secure +* Twistlock (Prisma Cloud Compute) +* Aqua Security +* Contrast ADR + +Cloud SIEM provides the following normalized runtime rule: + +* [Normalized Runtime Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01159.md) - Passes through an alert from a workload security agent and adjusts the severity accordingly based on the severity provided in the log. + +### cloud + +For messages that indicate a cloud posture, cloud threat, or cloud infrastructure finding. Out-of-the-box mappings for these sources haven't migrated yet. Until they do, these sources set `threat_ruleType` to `direct`. See [Behavior-based log mapping migration](#behavior-based-log-mapping-migration). + +Log sources that issue cloud-related messages include: + * AWS GuardDuty -* Varonis UBA -* G Suite Alert Center   +* AWS Security Hub +* Google Cloud SCC +* GCP IDS +* Orca Security +* Wiz +* Palo Alto Prisma Cloud +* Azure + +Cloud SIEM provides the following normalized cloud rule: + +* [Normalized Cloud Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01160.md) - Passes through an alert from a cloud security product and adjusts the severity accordingly based on the severity provided in the log. + +### identity + +For messages that indicate an identity or access anomaly, such as a risky sign-in, impossible travel, or compromised credentials. + +Log sources that issue identity-related messages include: + +* Microsoft Azure AD Identity Protection +* Microsoft Azure Advanced Threat Protection +* Microsoft Defender for Cloud Apps (MCAS) +* Microsoft Graph Identity Protection API +* Google Workspace Alert Center +* Okta +* Slack +* Box +* DocuSign Monitor +* Salesforce +* CrowdStrike Falcon Identity Protection + +Cloud SIEM provides the following normalized identity rule: + +* [Normalized Identity Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01161.md) - Passes through an alert from an identity or access product and adjusts the severity accordingly based on the severity provided in the log. + +### network + +For messages that indicate a network-layer detection, such as an IDS/IPS alert, a command-and-control callback, or a lateral movement indicator. These include NDR and WAF detections. + +Log sources that issue network-related messages include: + +* Palo Alto Firewall +* Fortinet +* Kemp LoadMaster +* FireEye CMS +* Vectra AI and Vectra Cognito +* Claroty xDome +* Darktrace +* AlphaSOC +* CrowdStrike FDR +* Bitdefender GravityZone +* Trend Micro Control Manager + +Cloud SIEM provides the following normalized network rule: + +* [Normalized Network Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01162.md) - Passes through an alert from a network security product and adjusts the severity accordingly based on the severity provided in the log. + +### data_protection + +For messages that indicate a data protection detection, such as a DLP violation, an email security detection, a deception alert, or an application security finding. + +Log sources that issue data protection-related messages include: + +* Netskope +* Varonis (DatAlert and DatAdvantage) +* Egnyte DLP +* Microsoft Office 365 (DLP and compliance) +* Microsoft Graph Security API (Microsoft IPC and Office 365 Security and Compliance) +* Proofpoint TRAP +* Mimecast +* Check Point Avanan +* Akamai CPC +* Akamai Noname API Security +* Thinkst Canary +* IBM Guardium +* CrowdStrike Falcon data protection detections +* Fortinet DLP +* Google Workspace Alert Center (DLP) + +Cloud SIEM provides the following normalized data protection rule: + +* [Normalized Data Protection Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01163.md) - Passes through an alert from a data protection product and adjusts the severity accordingly based on the severity provided in the log. + +## Behavior-based log mapping migration + +The `endpoint`, `runtime`, `cloud`, `identity`, `network`, and `data_protection` types are new. Out-of-the-box log mappings that previously set `threat_ruleType` to `direct` are being reassigned to these types in phases, so that behavior-based detections are easier to tune and carry more context than the single [Normalized Security Signal](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S00402.md) passthrough rule provides. + +| `threat_ruleType` | Out-of-the-box mapping migration | +|---|---| +| `runtime` | Completed August 4, 2026 | +| `identity` | Completed August 4, 2026 | +| `network` | Completed August 17, 2026 | +| `data_protection` | Completed August 17, 2026 | +| `cloud` | Target: On Hold | +| `endpoint` | Target: On Hold | + +:::note +All six rules are available now, but out-of-the-box log mappings are migrating in phases. The remaining dates in the table are targets and may shift. For the actual dates that out-of-the-box mappings migrate, monitor the [Cloud SIEM content release notes](/release-notes-cse/). Until a source's out-of-the-box mappings are migrated, its records keep a `threat_ruleType` of `direct` and continue to fire [Normalized Security Signal](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S00402.md). + +This migration changes only out-of-the-box log mappings. Your own log mappings aren't affected, and they keep whatever `threat_ruleType` value you set. To send records from your own mappings to one of the new rules, set `threat_ruleType` to that type. +::: + +Types are assigned per log mapping, not per vendor, so a single security product can contribute to several types. For example, out-of-the-box CrowdStrike log mappings are assigned to `endpoint`, `identity`, `network`, and `data_protection`. + +### Migrate custom content -Cloud SIEM provides the following normalized direct rule: +Custom content that depends on [Normalized Security Signal](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S00402.md) won't apply to records once their out-of-the-box mappings are migrated. For sources that haven't migrated yet, make these updates before their target date: -* [Normalized Security Signal](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S00402.md) - Passes through an alert from an endpoint security product and adjusts the severity accordingly based on the severity provided in the log. +* Re-scope any [rule tuning expressions](/docs/cse/rules/rule-tuning-expressions) on `MATCH-S00402` to the new rule IDs for those sources. +* If there are custom rules based on `MATCH-S00402` or utilizing `threat_ruleType = 'direct'`, migrate expression logic to the new detection category rules as tuning expressions or modify those rules to use the new `threat_ruleType` values. For example, if you have a custom rule that looks for `threat_ruleType = 'direct'` and a specific signature, you can change it to look for `threat_ruleType = 'endpoint'` and the same signature once the source's out-of-the-box mappings are migrated. +* Update any [custom insights](/docs/cse/records-signals-entities-insights/configure-custom-insight) that reference `MATCH-S00402`. +* Update saved searches, dashboards, or automations that filter on `threat_ruleType = 'direct'`.