IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Log Sources stopped rule with sequence test

    Posted 02/23/23 09:55 AM

    Hello,

    there was a blog post/tech note/discussion/comment somewhere on how to build a rule based on Building Blocks and the test when these rules match at least this many times in this many minutes after any of these rules match with the same event properties, so without the when the event(s) have not been detected by one or more of these log sources for this many seconds test and without a Reference Set.

    Does anyone have the link or know how to construct such a rule?

    Best regards
    Simon



  • 2.  RE: Log Sources stopped rule with sequence test

    Posted 03/15/23 03:48 AM

    Found the answer in one of the built-in rules:

    Apply Device Stopped Sending Events (Firewall, IPS, VPN or Switch) on events which are detected by the Local system
    and when none of BB:DeviceDefinition: FW / Router / Switch, BB:DeviceDefinition: IDS / IPS, BB:DeviceDefinition: VPN match in 30 minutes after BB:DeviceDefinition: FW / Router / Switch, BB:DeviceDefinition: IDS / IPS, BB:DeviceDefinition: VPN match with the same Log Source



    ------------------------------
    Simon S.
    ------------------------------



Related Content