Added the is_alert flag to the dictionary, the security_control profi…

…le and detection_finding class (#1178)

#### Related Issue: 1177

#### Description of changes:
Added an attribute, `is_alert` that indicates that an event is an
alertable signal, either determined by a security product monitoring
activities, via the `Security Control` profile, or by an analytic
process on one or more events via the `Detection Finding` class.

Note that not all findings are alertable signals, for example
`detection_finding`s have Update and Close activities that likely would
not be alertable, while Create activities might be.

In addition, added the `confidence` and `risk` family of attributes to
the `Security Control` profile, and a missing `risk_details` attribute
to `data_security_finding`.

Earlier versions of the PR, and the Issue #1177 were referring to the
`is_alert` attribute as `is_detection` but the meaning of the two are
not the same, in particular state changes in `detection_finding` while
`finding` events, are not themselves new detections warranting any
signaling (unless an incident management system wants to issue update
alerts as one example).

---------

Signed-off-by: Paul Agbabian <[email protected]>
Co-authored-by: Rajas <[email protected]>

CHANGELOG.md

@@ -53,13 +53,17 @@ Thankyou! -->
     4. Added `forward_addr` as an `email_t`. #1179
     5. Added `related_cves`, `related_cwes` as arrays of `cve`, `cwe` respectively. #1176
     6. Added `exploit_last_seen_time` as a `timestamp_t`. #1176
+    7. Added `is_alert` as a `boolean_t`, #1179
+
 * #### Objects
     1. Added `environment_variable` object. #1172
     2. Added `advisory` object. #1176
 
 ### Improved
 * #### Event Classes
     1. Added `evidences` to `compliance_finding` class. #1157
+    2. Added `is_alert` to `detection_finding` and `data_security_finding` classes. #1178
+    3. Added `risk_details` to `data_security_finding` class
 * #### Objects
     1. Added `phone_number` to `user` and `ldap_person` objects. #1155
     2. Added `has_mfa` to `user` object. #1155
@@ -74,6 +78,11 @@ Thankyou! -->
 ### Bugfixes
 1. Added sibling definition to `confidence_id` in dictionary, accurately associating `confidence` as its sibling. #1180
 
+* #### Profiles
+    1. Added `is_alert`, `confidence_id`, `confidence`,  `confidence_score` attributes to the `security_control` profile. #1178
+    2. Added `risk_level_id`, `risk_level`, `risk_score`, `risk_details` attributes to the `security_control` profile.  #1178
+    3. Added `policy` attribute to the `security_control` profile. #1178
+
 ### Deprecated
 1. Deprecated `project_uid` in favor of `account.uid`. #1166
 2. Deprecated `kb_article_list` in favor of `advisory` in the vulnerability object. #1176

dictionary.json

@@ -2423,6 +2423,11 @@
       "description": "The IP address, in either IPv4 or IPv6 format.",
       "type": "ip_t"
     },
+    "is_alert": {
+      "caption": "Alert",
+      "description": "Indicates that the event is considered to be an alertable signal.",
+      "type": "boolean_t"
+    },
     "is_applied": {
       "caption": "Applied",
       "description": "A determination if a policy, rule, or enforcement action was applied.",

events/findings/data_security_finding.json

@@ -39,6 +39,21 @@
             "group": "context",
             "requirement": "recommended"
         },
+        "confidence": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },
+         "confidence_id": {
+            "profile": null,
+            "group": "context",
+            "requirement": "recommended"
+        },
+        "confidence_score": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },      
         "data_security": {
             "group": "context",
             "requirement": "recommended"
@@ -80,21 +95,34 @@
             "group": "context",
             "requirement": "optional"
         },
+        "is_alert": {
+            "profile": null,
+            "group": "primary",
+            "requirement": "recommended"
+        },      
         "resources": {
             "caption": "Affected Resources",
             "description": "Describes details about resources where classified or sensitive data is stored in, or was accessed from.",
             "group": "context",
             "requirement": "recommended"
         },
+        "risk_details": {
+            "profile": null,
+            "group": "context",
+            "requirement": "optional"
+        },
         "risk_level": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },
         "risk_level_id": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },
         "risk_score": {
+            "profile": null,
             "group": "context",
             "requirement": "optional"
         },

events/findings/detection_finding.json

@@ -1,13 +1,28 @@
 {
   "uid": 4,
   "caption": "Detection Finding",
-  "description": "A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the <code>security_control</code> profile should be applied and its <code>attacks</code> information should be duplicated into the <code>finding_info</code> object.",
+  "description": "A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the <code>security_control</code> profile should be applied and its <code>attacks</code> information, if present, should be duplicated into the <code>finding_info</code> object.",
   "extends": "finding",
   "name": "detection_finding",
   "attributes": {
     "$include": [
       "profiles/security_control.json"
     ],
+    "confidence": {
+      "profile": null,
+      "group": "context",
+      "requirement": "optional"
+    },
+    "confidence_id": {
+      "profile": null,
+      "group": "context",
+      "requirement": "recommended"
+    },
+    "confidence_score": {
+      "profile": null,
+      "group": "context",
+      "requirement": "optional"
+    },
     "evidences": {
       "group": "primary",
       "description": "Describes various evidence artifacts associated to the activity/activities that triggered a security detection.",
@@ -25,6 +40,11 @@
       "group": "context",
       "requirement": "optional"
     },
+    "is_alert": {
+      "profile": null,
+      "group": "primary",
+      "requirement": "recommended"
+    },
     "remediation": {
       "group": "context",
       "requirement": "optional"
@@ -36,18 +56,22 @@
       "requirement": "recommended"
     },
     "risk_details": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_level": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_level_id": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },
     "risk_score": {
+      "profile": null,
       "group": "context",
       "requirement": "optional"
     },

profiles/security_control.json

@@ -1,5 +1,5 @@
 {
-  "description": "The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, firewall, or data control.  The profile is intended to augment activities or findings with an outcome where a security control has intervened.",
+  "description": "The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, firewall, or data control.  The profile is intended to augment activities or findings with an outcome where a security control has intervened. If the control detected a security violation, the <code>is_detection</code> flag should be set to <code>true</code>.",
   "meta": "profile",
   "caption": "Security Control",
   "name": "security_control",
@@ -37,17 +37,53 @@
     "authorizations": {
       "requirement": "optional"
     },
+    "confidence": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "confidence_id": {
+      "group": "context",
+      "requirement": "recommended"
+    },
+    "confidence_score": {
+      "group": "context",
+      "requirement": "optional"
+    },
     "disposition": {
       "requirement": "optional"
     },
     "disposition_id": {
       "requirement": "recommended"
     },
     "firewall_rule": {
-      "requirement": "optional"
+      "requirement": "optional",
+      "description": "The firewall rule that pertains to the control that triggered the event, if applicable."
+    },
+    "is_alert": {
+      "requirement": "recommended"
     },
     "malware": {
       "requirement": "optional"
+    },
+    "policy": {
+      "requirement": "optional",
+      "description": "The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy."
+    },
+    "risk_details": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_level": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_level_id": {
+      "group": "context",
+      "requirement": "optional"
+    },
+    "risk_score": {
+      "group": "context",
+      "requirement": "optional"
     }
   }
 }