From a2e04429a61fe281474b06a61023b5990de97cd3 Mon Sep 17 00:00:00 2001 From: Paul Agbabian Date: Fri, 27 Sep 2024 11:45:53 -0700 Subject: [PATCH] Added the is_alert flag to the dictionary, the security_control profile and detection_finding class (#1178) #### Related Issue: 1177 #### Description of changes: Added an attribute, `is_alert` that indicates that an event is an alertable signal, either determined by a security product monitoring activities, via the `Security Control` profile, or by an analytic process on one or more events via the `Detection Finding` class. Note that not all findings are alertable signals, for example `detection_finding`s have Update and Close activities that likely would not be alertable, while Create activities might be. In addition, added the `confidence` and `risk` family of attributes to the `Security Control` profile, and a missing `risk_details` attribute to `data_security_finding`. Earlier versions of the PR, and the Issue #1177 were referring to the `is_alert` attribute as `is_detection` but the meaning of the two are not the same, in particular state changes in `detection_finding` while `finding` events, are not themselves new detections warranting any signaling (unless an incident management system wants to issue update alerts as one example). --------- Signed-off-by: Paul Agbabian Co-authored-by: Rajas <89877409+floydtree@users.noreply.github.com> --- CHANGELOG.md | 9 +++++ dictionary.json | 5 +++ events/findings/data_security_finding.json | 28 +++++++++++++++ events/findings/detection_finding.json | 26 +++++++++++++- profiles/security_control.json | 40 ++++++++++++++++++++-- 5 files changed, 105 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7da3c62c7..2dbaa3923 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -53,6 +53,8 @@ Thankyou! --> 4. Added `forward_addr` as an `email_t`. #1179 5. Added `related_cves`, `related_cwes` as arrays of `cve`, `cwe` respectively. #1176 6. Added `exploit_last_seen_time` as a `timestamp_t`. #1176 + 7. Added `is_alert` as a `boolean_t`, #1179 + * #### Objects 1. Added `environment_variable` object. #1172 2. Added `advisory` object. #1176 @@ -60,6 +62,8 @@ Thankyou! --> ### Improved * #### Event Classes 1. Added `evidences` to `compliance_finding` class. #1157 + 2. Added `is_alert` to `detection_finding` and `data_security_finding` classes. #1178 + 3. Added `risk_details` to `data_security_finding` class * #### Objects 1. Added `phone_number` to `user` and `ldap_person` objects. #1155 2. Added `has_mfa` to `user` object. #1155 @@ -74,6 +78,11 @@ Thankyou! --> ### Bugfixes 1. Added sibling definition to `confidence_id` in dictionary, accurately associating `confidence` as its sibling. #1180 +* #### Profiles + 1. Added `is_alert`, `confidence_id`, `confidence`, `confidence_score` attributes to the `security_control` profile. #1178 + 2. Added `risk_level_id`, `risk_level`, `risk_score`, `risk_details` attributes to the `security_control` profile. #1178 + 3. Added `policy` attribute to the `security_control` profile. #1178 + ### Deprecated 1. Deprecated `project_uid` in favor of `account.uid`. #1166 2. Deprecated `kb_article_list` in favor of `advisory` in the vulnerability object. #1176 diff --git a/dictionary.json b/dictionary.json index e6e89a4e1..03f7abcdc 100644 --- a/dictionary.json +++ b/dictionary.json @@ -2423,6 +2423,11 @@ "description": "The IP address, in either IPv4 or IPv6 format.", "type": "ip_t" }, + "is_alert": { + "caption": "Alert", + "description": "Indicates that the event is considered to be an alertable signal.", + "type": "boolean_t" + }, "is_applied": { "caption": "Applied", "description": "A determination if a policy, rule, or enforcement action was applied.", diff --git a/events/findings/data_security_finding.json b/events/findings/data_security_finding.json index cecebac57..f6e9fb4cc 100644 --- a/events/findings/data_security_finding.json +++ b/events/findings/data_security_finding.json @@ -39,6 +39,21 @@ "group": "context", "requirement": "recommended" }, + "confidence": { + "profile": null, + "group": "context", + "requirement": "optional" + }, + "confidence_id": { + "profile": null, + "group": "context", + "requirement": "recommended" + }, + "confidence_score": { + "profile": null, + "group": "context", + "requirement": "optional" + }, "data_security": { "group": "context", "requirement": "recommended" @@ -80,21 +95,34 @@ "group": "context", "requirement": "optional" }, + "is_alert": { + "profile": null, + "group": "primary", + "requirement": "recommended" + }, "resources": { "caption": "Affected Resources", "description": "Describes details about resources where classified or sensitive data is stored in, or was accessed from.", "group": "context", "requirement": "recommended" }, + "risk_details": { + "profile": null, + "group": "context", + "requirement": "optional" + }, "risk_level": { + "profile": null, "group": "context", "requirement": "optional" }, "risk_level_id": { + "profile": null, "group": "context", "requirement": "optional" }, "risk_score": { + "profile": null, "group": "context", "requirement": "optional" }, diff --git a/events/findings/detection_finding.json b/events/findings/detection_finding.json index 2417cd2e7..f58911840 100644 --- a/events/findings/detection_finding.json +++ b/events/findings/detection_finding.json @@ -1,13 +1,28 @@ { "uid": 4, "caption": "Detection Finding", - "description": "A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the security_control profile should be applied and its attacks information should be duplicated into the finding_info object.", + "description": "A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the event producer is a security control, the security_control profile should be applied and its attacks information, if present, should be duplicated into the finding_info object.", "extends": "finding", "name": "detection_finding", "attributes": { "$include": [ "profiles/security_control.json" ], + "confidence": { + "profile": null, + "group": "context", + "requirement": "optional" + }, + "confidence_id": { + "profile": null, + "group": "context", + "requirement": "recommended" + }, + "confidence_score": { + "profile": null, + "group": "context", + "requirement": "optional" + }, "evidences": { "group": "primary", "description": "Describes various evidence artifacts associated to the activity/activities that triggered a security detection.", @@ -25,6 +40,11 @@ "group": "context", "requirement": "optional" }, + "is_alert": { + "profile": null, + "group": "primary", + "requirement": "recommended" + }, "remediation": { "group": "context", "requirement": "optional" @@ -36,18 +56,22 @@ "requirement": "recommended" }, "risk_details": { + "profile": null, "group": "context", "requirement": "optional" }, "risk_level": { + "profile": null, "group": "context", "requirement": "optional" }, "risk_level_id": { + "profile": null, "group": "context", "requirement": "optional" }, "risk_score": { + "profile": null, "group": "context", "requirement": "optional" }, diff --git a/profiles/security_control.json b/profiles/security_control.json index 463210d60..7ef74e7da 100644 --- a/profiles/security_control.json +++ b/profiles/security_control.json @@ -1,5 +1,5 @@ { - "description": "The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, firewall, or data control. The profile is intended to augment activities or findings with an outcome where a security control has intervened.", + "description": "The attributes including disposition that represent the outcome of a security control including but not limited to access control, malware or policy violation, network proxy, firewall, or data control. The profile is intended to augment activities or findings with an outcome where a security control has intervened. If the control detected a security violation, the is_detection flag should be set to true.", "meta": "profile", "caption": "Security Control", "name": "security_control", @@ -37,6 +37,18 @@ "authorizations": { "requirement": "optional" }, + "confidence": { + "group": "context", + "requirement": "optional" + }, + "confidence_id": { + "group": "context", + "requirement": "recommended" + }, + "confidence_score": { + "group": "context", + "requirement": "optional" + }, "disposition": { "requirement": "optional" }, @@ -44,10 +56,34 @@ "requirement": "recommended" }, "firewall_rule": { - "requirement": "optional" + "requirement": "optional", + "description": "The firewall rule that pertains to the control that triggered the event, if applicable." + }, + "is_alert": { + "requirement": "recommended" }, "malware": { "requirement": "optional" + }, + "policy": { + "requirement": "optional", + "description": "The policy that pertains to the control that triggered the event, if applicable. For example the name of an anti-malware policy or an access control policy." + }, + "risk_details": { + "group": "context", + "requirement": "optional" + }, + "risk_level": { + "group": "context", + "requirement": "optional" + }, + "risk_level_id": { + "group": "context", + "requirement": "optional" + }, + "risk_score": { + "group": "context", + "requirement": "optional" } } }