Falcon_User_Activity_Containment_Requested
ID: 100429
Description:
CrowdStrike Falcon User Activity Containment Requested - KLK
Repository: Group: CrowdStrikeES Type: event
Default Status:
Enabled
| Tags: | |
|---|---|
| CrowdStrike | Falcon |
Selector:
Query:
Filters:
| Field | MUST hit |
|---|---|
| event.module | crowdstrike |
| crowdstrike.metadata.eventType | UserActivityAuditEvent |
| crowdstrike.event.OperationName | containment_requested |
| Field | MUST NOT hit |
|---|---|
Behavior Rule:
| Key | Type | Behavior Category |
|---|---|---|
| crowdstrike.event.UserId | username | security alert |
Risks:
| Risks | Base Score | Dimension |
|---|---|---|
Attributes:
| Alias | Key |
|---|---|
| EventType | crowdstrike.metadata.eventType |
| OperationName | crowdstrike.event.OperationName |
| ServiceName | crowdstrike.event.ServiceName |
| UserID | crowdstrike.event.UserId |
| UserIP | crowdstrike.event.UserIp |
| UTCTimestamp | crowdstrike.event.UTCTimestamp |
| City | _ip.city |
| Country | _ip.country |
| AuditKey | crowdstrike.event.AuditKeyValues.Key |
| AuditKeyValue | crowdstrike.event.AuditKeyValues.ValueString |
Correlation Rules:
First Occurrence:
| Name | Window | Fields |
|---|---|---|
| NewUser | 10 days | crowdstrike.event.UserId |
| Risks: | ML_NEW_USER | |
| NewCountry | 10 days | _ip.country |
| Risks: | ML_NEW_GEO_COUNTRY | |
| NewCity | 10 days | _ip.city |
| Risks: | ML_NEW_GEO_CITY | |
| NewActivity | 10 days | crowdstrike.event.OperationName |
| Risks: | ML_NEW_ALERT |
History:
| User | Date | | :— | :— | | — | — |
This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)