AnsweredAssumed Answered

ESA Rule Scope

Question asked by Deepak Shukla on Feb 19, 2019
Latest reply on Mar 8, 2019 by Josh Randall

Like • Show 0 Likes0
Comment • 11

Hi Team,

I am working on a use-case for CyberArk and would like to know if there is any feasibility to call "meta value" of any "meta key" in the "meta value" of another "meta key".

Scenario is: CyberArk-Password Retrieved from another user.

Case Study: Source Username is the field which capture affected user for which password is retrieved and destination username is the field which capture the detail of user who retried the password. Source Username will have additional pre-fix of "adm_". E.g. Source Username = adm_deepak and Destination Username = deepak.

My logic is to build something like, source username doesn't contain destination username.

Seeking your hep here.....

Regards,

Deepak Shukla

No one else has this question

Outcomes

11 Replies

Lee Kirkpatrick Feb 19, 2019 7:15 AM
Mark Correct
Correct Answer
Hey Deepak,

You sure can. The below will alert when user_src does not contain the value in user_dst (assuming user_src and _user_dst are from the same event):

SELECT * FROM Event(user_src NOT LIKE '%' || user_dst || '%')

Cheers,
Lee
Like • Show 1 Like1
Actions
- Deepak Shukla @ Lee Kirkpatrick on Feb 19, 2019 10:04 AM
  Mark Correct
  Correct Answer
  Hi Lee,
  
  Good to hear this.
  
  In my case source user name will have an additional prefix of "adm_".
  
  Does the shared syntax will suffice the purpose or I guess, have to put some regex in the same syntax to exclude the text "adm_". Does calling regex in same syntax will work?
  
  Thanks in Advance,
  Deepak Shukla
  Like • Show 0 Likes0
  Actions
  - Lee Kirkpatrick @ Deepak Shukla on Feb 19, 2019 10:45 AM
    Mark Correct
    Correct Answer
    Hey Deepak,
    
    It would work for what you have suggested as we are using a LIKE statement. Let's take an example whereby we have an event that contains two values:
    
    user_src = 'adm_deepak', user_dst = 'deepak'
    
    The logic posted above is looking for instances where user_src, which currently holds 'adm_deepak', not containing the value from user_dst, which currently holds 'deepak'. The value 'deepak' currently exists within user_dst, which is holding 'adm_deepak' - therefore there would be no alert.
    
    If we had two events like the below:
    
    user_src = 'adm_deepak', user_dst = 'evil'
    
    Now user_src still holds 'adm_deepak', but user_dst holds 'evil', the logic would look to see if the user_src value does not contain the value from user_dst. In this case 'evil' does not exist within 'adm_deepak' so you would get an alert.
    
    Cheers,
    Lee
    Like • Show 0 Likes0
    Actions
    - Deepak Shukla @ Lee Kirkpatrick on Feb 21, 2019 9:47 AM
      Mark Correct
      Correct Answer
      Hi Lee,
      
      Thank you so much for your inputs!
      
      I am totally a newbie in this EPL. Tried to create one but post deployment it got disabled automatically. Don't know what I am missing. Is it the very first line of module Module_esa000170;?
      
      ESA was unable to deploy one or more rules, and these rules were disabled. Common issues include: missing metadata, invalid rule syntax, and unavailable external connections at the time of deployment.
      
      /*
      Version: 3
      */
      module Module_esa000170;
      @Name('Module_esa000170_Alert')
      @RSAAlert(oneInSeconds=0)
      
      SELECT *
      FROM Event
      (
      (device_type.toLowerCase() IN ( 'cyberark' ))
      AND
      (action.toLowerCase() IN ( 'retrieve password' ))
      AND
      (user_src NOT LIKE '%' || user_dst || '%')
      )
      ;
      Like • Show 0 Likes0
      Actions
      - Eric Partington @ Deepak Shukla on Feb 21, 2019 1:49 PM
        Mark Correct
        Correct Answer
        @Name('ep_user_in_user') @RSAAlert(oneInSeconds=0) SELECT * FROM Event( device_type.toLowerCase() IN ( 'cyberark' ) AND isOneOfIgnoreCase(action,{ 'retrieve password' }) AND user_src NOT LIKE '%' || user_dst || '%' );
        
        the issue is that action is not a string but a string[] (vector) so you need a different advanced syntax for it. I usually try to build as much of the rule using the UI as possible and click show syntax so that i can get the right syntax and operators for the keys. It should be easier to do this than it is, but so far this is what we have to work with.
        Like • Show 2 Likes2
        Actions
        Deepak Shukla @ Eric Partington on Feb 22, 2019 5:16 AM
        Mark Correct
        Correct Answer
        Thanks again Eric ! Have placed the shared syntax, will see the outcome and trouble you again in-case required.
        Meanwhile I will gear-up you to learn EPL.
        
        Thanks alot.
        Like • Show 0 Likes0
        Actions
        Deepak Shukla @ Eric Partington on Feb 25, 2019 1:01 PM
        Mark Correct
        Correct Answer
        Hi Eric.
        Hope you are doing well. Until I well versed with the EPL syntax, needing your help with the correct syntaxs. Now I have below two more additional criteria to put in the rule. Want to trigger the rule when it matches '2' events in 'n' minutes.
        
        user.dst begins with "u"
        Event 1 "ip.add" != Event 2 "ip.add"
        
        Regards,
        Deepak Shukla
        Like • Show 0 Likes0
        Actions
        Eric Partington @ Deepak Shukla on Feb 28, 2019 9:59 AM
        Mark Correct
        Correct Answer
        @Name('ep_user_in_user') @RSAAlert(oneInSeconds=0) SELECT * FROM Event( device_type.toLowerCase() IN ( 'cyberark' ) AND isOneOfIgnoreCase(action,{ 'retrieve password' }) AND user_dst LIKE 'u%' AND user_src NOT LIKE '%' || user_dst || '%' );
        that should take care of the u* requirement
        will look at the other items you asked as well (adding a count window)
        1 person found this helpful
        Like • Show 0 Likes0
        Actions
        Deepak Shukla @ Eric Partington on Feb 28, 2019 10:22 AM
        Mark Correct
        Correct Answer
        Thanks alot Eric.... Will wait for the matching of two events.
        Event 1 "ip.add" != Event 2 "ip.add"
        
        Regards,
        Deepak Shukla
        Like • Show 0 Likes0
        Actions
        Deepak Shukla @ Eric Partington on Mar 8, 2019 9:55 AM
        Mark Correct
        Correct Answer
        Hi Eric...Hope you are doing well ! Below is what i tried to create, unfortunately it is throwing error while saving. Do you mind to have a look and suggest.
        
        @Name('ep_user_in_user')
        @RSAAlert(oneInSeconds=0)
        SELECT * FROM PATTERN [
        every
        e1=Event(device_type.toLowerCase() IN ( 'cyberark' ) AND
        isOneOfIgnoreCase(action,{ 'retrieve password' }) AND
        user_dst LIKE 'u%' AND
        user_src NOT LIKE '%' || user_dst || '%'
        )
        ->
        e2=Event(device_type.toLowerCase() IN ( 'cyberark' ) AND
        isOneOfIgnoreCase(action,{ 'retrieve password' }) AND
        user_dst LIKE 'u%' AND
        user_src NOT LIKE '%' || user_dst || '%'
        AND ip_addr NOT LIKE '%' || e1.ip_addr || '%')
        where timer:within(30 Minutes)
        ];
        
        Regards,
        Deepak Shukla
        Like • Show 0 Likes0
        Actions
        Josh Randall @ Deepak Shukla on Mar 8, 2019 2:45 PM
        Mark Correct
        Correct Answer
        Deepak,
        Your rule copy/pasted into my ESA and saved without any errors, so it does not appear that you have any syntax issues within the rule itself. This may be a somewhat basic thing to check, but please make sure you have given your rule a name in the "Rule Name” line - if that is empty, you will not be able to save an otherwise-valid rule.
        
        One note on your rule as you have it written now - I would recommend changing
        
        AND ip_addr NOT LIKE '%' || e1.ip_addr || '%'
        
        …to
        
        AND NOT (ip_addr = e1.ip_addr)
        
        Also, when you said you wanted to match "'2' events in 'n' minutes,” can you be a bit more specific? Currently, your rule is already looking for 2 different events (e1 and e2) within 30 minutes. If you want to change the time window, you would just adjust the "timer:within(30 minutes)” statement.
        
        Or are you asking how to increase the number of events that the e1 and e2 statements will evaluate?
        Like • Show 1 Like1
        Actions

ESA Rule Scope

Outcomes

Related Content

Recommended Content