‎2011-12-21
09:47 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Correlation Rules for Virus Alerts
Hi all, What would be the best way to setup a correlation rule if I want to alert on say the same virus has been detected again within a week period? So if Monday virus X is detected and another X virus on Friday is detected it will generate an alert? Should it be multithreaded so it will start a new thread whenever a new virus is detected? Thanks.
2 Replies
‎2012-01-03
05:25 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
I've made a correlation rule for this, more or less. We would use it to identify something spreading on the network. Right now it will fire if the same virus is found on 3 hosts within an hour. It would be easy to modify it to increase the number of hosts or increase the timeframe.
I have attached the rule for you.
Note that it uses cache variables to determine if its the same virus on different hosts, not multithreading. The reason for this is that I like to see each of the messages that generate the alert. If you use multi threading it will only show you the last message to cause the alert to fire which annoys me.
‎2012-01-11
09:52 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Thanks!! I've put in the alert - waiting for a time to test it out.
It should work as I made an correlated alert on 3 accounts locked out within a short period using the same logic you provided.
It should work as I made an correlated alert on 3 accounts locked out within a short period using the same logic you provided.
