Thank you for the follow up. I will look into your suggestion in the mean time if there is anyone good with behavior rules, I am going to put the rule we tested here - definitely needs some tuning:
Need to work with someone that understands behavioral rules.
Apply (Event Name) when time series data is being aggregated by Log Source, EPS in Interval
and when SUM(EventCount) is the tested property
and when the importance of the current traffic level (on a scale of 0 to 100) is 70 compared to learned traffic trends and behavior
and when the importance of the current traffic trend (on a scale of 0 to 100) is 30 compared to learned traffic levels and behavior
and when the importance of the current traffic behavior (on a scale of 0 to 100) is 30 compared to learned traffic levels and trends
and when the actual field value deviates by a margin of at least 40% of the extrapolated (predicted) field value
and when the season length is a day
------------------------------
Russell Lieneman
------------------------------
Original Message:
Sent: Tue April 15, 2025 08:49 AM
From: Frank Eargle
Subject: Create Alert for when log source drops below baseline
Sorry, this somehow got buried. Yes Gladys has left IBM but we used to work very closely with her. Unfortunately nothing quite answers the problem of log sources stopping or a statistical anomaly in the EPS rate. We have written our own logic as I mentioned in the previous post. Basically we create a reference set with a time to live matching the desired time frame. We write an update rule based on the log source group (1hr, 2hr, 24hr and clusters) which updates the reference set only when 1/2 the time has passed (in order to keep load on DB and system low). Then we write a rule that fires an offense when an entry expires out of the reference set. Clusters have slightly different logic. Search this forum for how that is done, but it is basically the same methods, just that either host logging is acceptable.
Hope this helps.
-Frank
------------------------------
Frank Eargle
Senior Information Security Architect
GlassHouse Systems
Columbia SC
803-237-4497
------------------------------
Original Message:
Sent: Thu February 20, 2025 03:45 PM
From: Russell Lieneman
Subject: Create Alert for when log source drops below baseline
Found some stuff here for her:
https://community.ibm.com/community/user/security/blogs/gladys-koskas1/2022/05/24/highlights-of-qradar-content
Might also be some info found here:
https://community.ibm.com/community/user/security/blogs/gladys-koskas1/2022/09/29/everything-you-need-to-know-about-qradar-rules
@Frank Eargle do either of these look familiar?
------------------------------
Russell Lieneman
Original Message:
Sent: Thu February 20, 2025 08:29 AM
From: Frank Eargle
Subject: Create Alert for when log source drops below baseline
We are writing a machine learning app to do it. The built in anomaly stuff is pretty good for thresholds and stuff like that. The best one to use is the Behavioral rule, but you have to have the query perfect and the importance values. I have actually read some of the math involved, Gladys Koscas shared when she was at IBM. I don't have the links available. Figure out how to use those behavioral rules, they are well worth the time.
------------------------------
Frank Eargle