KSA-ECC – AI Engine Rules
| AI Engine Rules | Rule ID | Description | Control Support | Alarming | Classifications | Log Sources |
|---|---|---|---|---|---|---|
| CCF: Abnormal Amount of Data Transferred | 1230 | This rule alerts whenever a significant change (400% increase or 75% decrease) in Bytes In or Bytes Out from a specific host. | 2.3.3 | No | Operations : Warning | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Abnormal Origin Location | 1208 | First tracks geographic locations for logins. Afterwards, triggers when a new origin location is seen for a user. | 2.2.3, 2.5.3, 2.15.3, 3.1.3, 5.1.3 | No | Security : Attack | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Account Deleted Rule | 1367 | This rule provides details of accounts that have been deleted | 2.2.3 | No | Audit: Account Deleted | Include All Log Sources |
| CCF: Account Disabled Rule | 1369 | This AIE Rule alerts on the occurrence of any access revoking to accounts. | 2.2.3 | No | Audit: Access Revoked | Include All Log Sources |
| CCF: Account Enabled Rule | 1368 | This AIE Rule alerts on the occurrence of any access granting to accounts. | 2.2.3 | Yes | Audit: Access Granted | Include All Log Sources |
| CCF: Account Modification | 1377 | This AIE Rule creates a common event and provides detail around account modification activity. | 2.2.3 | No | Audit : Account Modified | Include All Log Sources |
| CCF: Admin Password Modified | 1326 | User changes the password of a different privileged user account. | 2.2.3 | No | Security: Suspicious | Include All Log Sources |
| CCF: Attack then External Connection | 1211 | An observed external attack or compromise followed by data leaving the system and going to the attacker. | 2.13.1, 3.1.3, 5.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Audit Logging Stopped Alarm | 1328 | This AIE Rule provides details on audit logging being stopped. | 3.1.3, 5.1.3 | Yes | Audit : Configuration | Include All Log Sources |
| CCF: Auth After Numerous Failed Auths | 1199 | Multiple external unique login attempts are seen on the same impacted host within a short period of time, followed by a successful authentication. | 2.15.3, 5.1.3 | No | Security : Compromise | 1. Include All Log Sources |
| CCF: Auth After Security Event | 1200 | An observed attack, compromise, or other security event followed by successful access or authentication from the attacking host. | 2.13.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Backup Failure Alarm | 1236 | More than 10 backup failure events are detected. | 2.3.3, 2.9.3 | Yes | Operations : Error | Include All Log Sources |
| CCF: Backup Information | 1237 | This AIE Rule creates events for information from backup software. | 2.3.3, 2.9.3 | No | Operations : Information | Include All Log Sources |
| CCF: Blacklist Location Auth | 1204 | Authentication success from a blacklisted location. | 2.2.3, 2.5.3, 2.15.3, 3.1.3, 5.1.3 | No | Security : Compromise | Include All Log Sources |
| CCF: Blacklisted Account Alarm | 1334 | This AIE creates an alarm when a blacklisted account activity occurs within the environment. This requires the CCF: User Blacklist to be populated and updated regularly. | 2.2.3, 3.1.3, 5.1.3 | Yes | Audit : Other Audit Success | Include All Log Sources |
| CCF: Compromise Detected Alarm | 1335 | This AIE rule creates an event and alerts on potential compromises across the environment. | 2.3.3, 2.5.3, 2.13.3, 2.15.3, 3.1.3, 5.1.3 | Yes | Security : Compromise | Include All Log Sources |
| CCF: Concurrent VPN from Multiple Locations | 1205 | Multiple VPN authentication successes from the same origin login are observed from different regions within a given time period (default 3 hours). | 2.2.3, 2.5.3, 2.15.3, 3.1.3, 5.1.3 | No | Security : Compromise | Include All Log Sources |
| CCF: Concurrent VPN from Same User | 1373 | This AIE Rule alerts on the occurrence of concurrent VPN from the same user. | 2.2.3 | No | Security : Suspicious | Include All Log Sources |
| CCF: Config Change After Attack | 1214 | Attack event on a host followed by a configuration change made to that host within 3 minutes. | 2.3.3, 2.4.3, 2.5.3, 2.10.3, 3.1.3, 5.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Config Change then Critical Error | 1216 | Configuration change followed by a critical error on the same host indicating an erroneous configuration, malicious intent or otherwise. | 2.3.3, 2.4.3, 2.5.3, 2.10.3, 3.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Config Deleted/Disabled | 1219 | Configuration deleted or disabled within the organization infrastructure. | 2.3.3, 2.4.3, 2.5.3, 2.10.3, 2.15.3, 3.1.3, 5.1.3 | No | Security : Compromise | CCF: Production Servers |
| CCF: Config Modified | 1221 | Configuration modified within the organization infrastructure. | 2.3.3, 2.4.3, 2.5.3, 2.10.3, 2.15.3, 3.1.3, 5.1.3 | No | Security : Compromise | Include All Log Sources |
| CCF: Corroborated Account Anomalies | 1207 | 3 or more unique behavioral anomalies for a given user within a 3 hour period. This rule requires Rule IDs 285 - 289 be turned on. Use Case : An account has been compromised. | 2.2.3, 2.5.3, 3.1.3, 5.1.3 | No | Security : Compromise | Include All Log Sources |
| CCF: Corroborated Data Access Anomalies | 1201 | 2 or more unique behavioral anomalies for data within a 3 hour periods. The alarm requires rule IDs 300-302 be turned on for this alarm to trigger. | 2.7.3, 2.15.3, 3.1.3, | No | Security : Compromise | Include All Log Sources |
| CCF: Critical Event After Attack | 1206 | An external attack or compromise followed by a critical event on the same host. Action: This alarm can identify when an error message is generated as the result of a successful attack. This can be unexpected process termination or a hardware fail | 3.1.3, 5.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Critical/PRD Envir Patch Failure Alarm | 1212 | This AIE rule creates an alert any time a patch fails to apply to the critical or production environments (entity structure). | 1.6.3, 2.3.3, 2.4.3, 2.10.3, 3.1.3, 5.1.3 | Yes | Operations : Error | Include All Log Sources |
| CCF: Data Destruction | 1202 | Attack event followed by a FIM delete/modify event on the same host. | 2.3.3, 2.7.3, 3.1.3 | No | Security : Compromise | Include All Log Sources |
| CCF: Data Exfiltration Observed | 1193 | External attack or compromise followed by data leaving the same system. | 2.3.3, 2.7.3, 3.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Data Loss Prevention | 1232 | This AIE Rule provides details of data generated by the LogRhythm Data Loss Defender or other data loss prevention solutions, when configured. | 2.3.3, 2.7.3 | No | Operations : Information | Include All Log Sources |
| CCF: Denial of Service Alert | 1376 | This AIE Rule alerts on the occurrence of any identified Denial of Service event. | 2.3.3, 2.13.3 | Yes | Security: Denial Of Service | Include All Log Sources |
| CCF: Disabled Account Auth Success | 1194 | Recently disabled or deleted account authenticates or accesses resources on the network. | 1.9.5, 2.2.3, 3.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Distributed Brute Force | 1203 | A successful brute force authentication -- multiple failed authentication attempts from different external hosts to the same host using the same origin login, followed by an authentication success. | 2.3.3, 2.5.3, 2.13.3, 2.15.3, 3.1.3, 5.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Early TLS/SSL Alarm | 1238 | This AIE Rule alerts on the occurrence of any identified TLS LogRhythm Network Monitor event. | 2.3.3, 2.5.3, 2.8.3, 2.10.3, 3.1.3, 5.1.3 | Yes | Security : Activity | Include All Log Sources |
| CCF: Excessive Authentication Failures Rule | 1370 | This AIE Rule supports alerting on >10 authentication failures in 30 minutes (login failures). Match this threshold to your organization's specific authentication failure policies. | 2.2.3 | Yes | Audit : Authentication Failure | Include All Log Sources |
| CCF: External Brute Force Auths | 1197 | Successful authentication after multiple failed attempts from different external origin hosts to the same impacted host. | 2.13.3, 2.15.3, 3.1.3, 5.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: FIM Abnormal Activity | 1233 | This AIE Rule creates events for all abnormal file integrity monitoring activity. | 2.7.3 | No | Security : Suspicious | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: FIM Add Activity | 1234 | This AIE Rule creates events for all file integrity monitoring add activity. | 2.7.3 | No | Security : Activity | Include All Log Sources |
| CCF: FIM Delete Activity Alarm | 1235 | This AIE Rule alarms on file integrity monitoring delete activity. | 2.7.3 | Yes | Security : Activity | Include All Log Sources |
| CCF: FIM General Activity | 1239 | This rule creates an event fir file integrity monitoring activity including adds, deletes, modifies, group changes, owner changes, and permissions. The FIM log source can be established from LogRhythm's FIM or other FIM solutions. | 2.7.3 | No | Operations : Information | Include All Log Sources |
| CCF: FIM Information | 1229 | This AIE Rule creates events for general file integrity monitoring information. | 2.7.3 | No | Operations : Information | Include All Log Sources |
| CCF: GeoIP Blacklisted Region Activity | 1241 | This rule tracks activity associated with Blacklisted Regions (list). | 2.2.3, 2.3.3, 4.2.3 | No | Security : Suspicious | Include All Log Sources |
| CCF: GeoIP General Activity | 1240 | This rule is designed to use with the Data Processor's GeoIP functionality, to represent general GeoIP activity. | 2.2.3, 2.3.3, 4.2.3 | No | Security : Suspicious New: Operations : Information | Include All Log Sources |
| CCF: Large Outbound Transfer | 1195 | Single host is seen sending over 1GB of data within 30 minutes out of the network. | 2.2.3, 2.3.3, 4.2.3 | No | Security : Compromise | Include All Log Sources |
| CCF: Linux sudo Privilege Escalation | 1330 | User not in the LogRhythm list "CCF: Privileged Accounts" and not in the local 'sudoers' file tries to use sudo on a Linux host. | 2.3.3, 2.7.3, 3.1.3 | No | Security : Suspicious | Include All Log Sources |
| CCF: Local Account Created and Used | 1196 | An account is created on a host and then used shortly thereafter on the same host. | 2.2.3, 3.1.3 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: LogRhythm Silent Log Source Error Alarm | 1209 | This AIE Rule creates an alert and provides information when a LogRhythm Log Source has not received logs from a critical or production server-system during the defined error period. | 2.3.3 | Yes | Operations : Warning | Include All Log Sources |
| CCF: Malware Alarm | 1217 | This AIE Rule provides details on malware activity across the organization's environment where malware detection/prevention is applied. | 2.3.3, 2.13.3, 3.1.3, 5.1.3 | Yes | Security : Malware | Include All Log Sources |
| CCF: Misuse | 1231 | This AIE Rule provides details on misuse activity. | 3.1.3, 5.1.3 | No | Security : Misuse | Include All Log Sources |
| CCF: Multiple Account Passwords Modified by Admin | 1327 | An observed login by a user in the privileged user list followed by the change of two or more other account passwords. | 2.2.3 | No | Security: Suspicious | Include All Log Sources |
| CCF: Non-Encrypted Protocol Alarm | 1222 | This investigation provides details of unencrypted applications being utilized within the critical and production systems or environments (entity structure). | 2.3.3, 2.5.3, 2.7.3, 2.8.3, 2.10.3, 2.15.3, 5.1.3 | Yes | Operations : Information | Include All Log Sources |
| CCF: Password Modified by Admin | 1325 | Privileged user changes the password of another account. | 2.2.3 | No | Security: Suspicious | Include All Log Sources |
| CCF: Password Modified by Another User | 1333 | User changes the password of another account (not their own). | 2.2.3 | No | Audit: Account Modified | Include All Log Sources |
| CCF: Physical Access Rule | 1498 | This AIE rule creates an event for any access attempts (success or failure) to the defined physical security boundary. | 2.14.3 | No | Audit: Policy | Include All Log Sources |
| CCF: PRD Envir Config/Policy Change Alarm | 1210 | This AIE rule creates an alert any time a configuration or policy modification logs are received from a critical or production environment (entity structure). | 2.4.3, 2.10.3, 2.15.3, 3.1.3, 5.1.3 | Yes | Audit : Policy | CCF: Production Servers |
| CCF: PRD Envir Signature Failure Alarm | 1213 | This AIE Rule creates an alert on signature update failures on critical or production environments (entity structure). | 1.6.3, 2.3.3, 2.4.3, 2.10.3, 3.1.3, 5.1.3 | Yes | Operations : Error | Include All Log Sources |
| CCF: Priv Group Access Granted Alarm | 1324 | This AIE Rule provides details on access granted to privileged groups (administrators, dnsadmins, domain admins, enterprise admins, schema admins) within the organization infrastructure. | 2.2.3, 5.1.3 | Yes | Audit: Access Granted | Include All Log Sources |
| CCF: Privilege Escalation After Attack Alarm | 1329 | Compromised host event followed by a new account created or account modified on the same host. | 2.2.3, 3.1.3 | Yes | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources |
| CCF: Rogue Access Point Alarm | 1220 | This AIE Rule alerts on the occurrence of any rogue access point detection events against the organization's environment. | 2.3.3, 2.5.3, 2.10.3, 3.1.3, 5.1.3 | Yes | Security: Suspicious | Include All Log Sources |
| CCF: Software Install Failure Alarm | 1375 | This alerts on failed and incomplete updates attempts to update or install in the organization. | 2.3.3, 2.10.3 | Yes | Audit: Configuration | Include All Log Sources |
| CCF: Software Install Rule | 1371 | This AIE rule creates an event and alerts on any software installation activity across the environment. | 2.3.3, 2.10.3 | No | Audit : Configuration | Include All Log Sources |
| CCF: Software Uninstall Failure Alarm | 1374 | This alerts on failed or interrupted software uninstallations. | 2.3.3, 2.10.3 | Yes | Audit: Configuration | Include All Log Sources |
| CCF: Software Uninstall Rule | 1372 | This AIE rule creates an event and alerts on any software uninstallation activity across the environment. | 2.3.3, 2.10.3 | No | Audit : Configuration | Include All Log Sources |
| CCF: Suspected Wireless Attack Alarm | 1223 | This AIE Rule creates an event and alerts on suspected wireless attacks (success/failure) against the boundary monitoring devices. | 2.3.3, 2.13.3, 3.1.3, 5.1.3 | Yes | Security: Attack | CCF: Wireless IDS |
| CCF: Vulnerability Detected Alarm | 1218 | This AIE Rule alerts on the occurrence of vulnerabilities or suspicious events across the organization's environment. | 1.6.2, 1.6.3, 2.3.3, 2.5.3, 2.10.3, 3.1.3, 5.1.3 | Yes | Security: Vulnerability | Include All Log Sources |
| CCF: Windows RunAs Privilege Escalation | 1321 | User not in the LogRhythm List "Privileged Users" chooses to Run a Windows program as an administrator using the "Run as administrator" option. | 2.2.3, 3.1.3, 5.1.3 | No | Security : Suspicious | 1. Include All Log Sources 2. Include All Log Sources |