NY DFS – AI Engine Rules
AI Engine Rule Name | Rule Description | Corresponding Investigation | Augment Requirements | Alarming | Notification Area / Classification | Log Source | Rule ID |
|---|---|---|---|---|---|---|---|
CCF: Data Exfiltration Observed | External attack or compromise followed by data leaving the same system. | CCF: LogRhythm Data Loss Defender Log Inv | 500.05, 500.06, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1193 |
CCF: Disabled Account Auth Success | Recently disabled or deleted account authenticates or accesses resources on the network. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1194 |
CCF: Large Outbound Transfer | Single host is seen sending over 1GB of data within 30 minutes out of the network. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.13, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | Include All Log Sources | 1195 |
CCF: Local Account Created and Used | An account is created on a host and then used shortly thereafter on the same host. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1196 |
CCF: External Brute Force Auths | Successful authentication after multiple failed attempts from different external origin hosts to the same impacted host. | N/A | 500.05, 500.06, 500.09, 500.14, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1197 |
CCF: Auth After Numerous Failed Auths | Multiple external unique login attempts are seen on the same impacted host within a short period of time, followed by a successful authentication. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1199 |
CCF: Auth After Security Event | An observed attack, compromise, or other security event followed by successful access or authentication from the attacking host. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1200 |
CCF: Corroborated Data Access Anomalies | 2 or more unique behavioral anomalies for data within a 3 hour periods. The alarm requires rule IDs 300-302 be turned on for this alarm to trigger. | CCF: Suspicious Users Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | Include All Log Sources | 1201 |
CCF: Data Destruction | Attack event followed by a FIM delete/modify event on the same host. | CCF: LogRhythm Data Loss Defender Log Inv | 500.05, 500.06, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | Include All Log Sources | 1202 |
CCF: Distributed Brute Force | A successful brute force authentication -- multiple failed authentication attempts from different external hosts to the same host using the same origin login, followed by an authentication success. | N/A | 500.05, 500.06, 500.09, 500.14, 500.16, 500.17 | No | Security : Compromise | Include All Log Sources | 1203 |
CCF: Blacklist Location Auth | Authentication success from a blacklisted location. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | Include All Log Sources | 1204 |
CCF: Concurrent VPN from Multiple Locations | Multiple VPN authentication successes from the same origin login are observed from different regions within a given time period (default 3 hours). | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | Include All Log Sources | 1205 |
CCF: Critical Event After Attack | An external attack or compromise followed by a critical event on the same host. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1206 |
CCF: Corroborated Account Anomalies | 3 or more unique behavioral anomalies for a given user within a 3 hour period. This rule requires Rule IDs 285 - 289 be turned on. | CCF: Suspicious Users Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | Include All Log Sources | 1207 |
CCF: Abnormal Origin Location | First tracks geographic locations for VPN logins. Afterwards, triggers when a new origin location is seen for a user. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Attack | 1. Include All Log Sources 2. Include All Log Sources | 1208 |
CCF: LogRhythm Silent Log Source Error Alarm | This AIE Rule creates an alert and provides information when a LogRhythm Log Source has not received logs from a critical or production server-system during the defined error period. | CCF: Audit Log Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.13, 500.14, 500.15, 500.16, 500.17 | Yes | Operations : Warning | Include All Log Sources | 1209 |
CCF: PRD Envir Config/Policy Change Alarm | This AIE rule creates an alert any time a configuration or policy modification logs are received from a critical or production environment (entity structure). | CCF: Config/Policy Change Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Policy | CCF: Production Servers | 1210 |
CCF: Attack then External Connection | An observed external attack or compromise followed by data leaving the system and going to the attacker. | N/A | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1211 |
CCF: Critical/PRD Envir Patch Failure Alarm | This AIE rule creates an alert any time a patch fails to apply to the critical or production environments (entity structure). | CCF: Critical Environment Error Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.16, 500.17 | Yes | Operations : Error | Include All Log Sources | 1212 |
CCF: PRD Envir Signature Failure Alarm | This AIE Rule creates an alert on signature update failures on critical or production environments (entity structure). | N/A | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.16, 500.17 | Yes | Operations : Error | Include All Log Sources | 1213 |
CCF: Config Change After Attack | Attack event on a host followed by a configuration change made to that host within 3 minutes. | CCF: Config/Policy Change Inv | 500.05, 500.06, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1214 |
CCF: Time Sync Error Alarm | This AIE Rule creates an event and alerts for any time sync errors occurring on any Log Source. | CCF: Time Sync Error Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.13, 500.14, 500.15, 500.16, 500.17 | Yes | Operations : Warning | Include All Log Sources | 1215 |
CCF: Config Change then Critical Error | Configuration change followed by a critical error on the same host indicating an erroneous configuration, malicious intent or otherwise. | N/A | 500.05, 500.06, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | 1. Include All Log Sources 2. Include All Log Sources | 1216 |
CCF: Malware Alarm | This AIE Rule provides details on malware activity across the organization's environment where malware detection/prevention is applied. | CCF: Malware Detected Inv | 500.05, 500.06, 500.09, 500.14, 500.16, 500.17 | Yes | Security : Malware | Include All Log Sources | 1217 |
CCF: Vulnerability Detected Alarm | This AIE Rule alerts on the occurrence of vulnerabilities or suspicious events across the organization's environment. | CCF: Vulnerability Detected Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.16, 500.17 | Yes | Security : Vulnerability | Include All Log Sources | 1218 |
CCF: Config Deleted/Disabled | Configuration deleted or disabled within the organization infrastructure. | CCF: Config/Policy Change Inv | 500.05, 500.06, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | CCF: Production Servers | 1219 |
CCF: Rogue Access Point Alarm | This AIE Rule alerts on the occurrence of any rogue access point detection events against the organization's environment. | CCF: Rogue Access Point Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.16, 500.17 | Yes | Security : Suspicious | Include All Log Sources | 1220 |
CCF: Config Modified | Configuration modified within the organization infrastructure. | CCF: Config/Policy Change Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.17 | No | Security : Compromise | Include All Log Sources | 1221 |
CCF: Non-Encrypted Protocol Alarm | This investigation provides details of unencrypted applications being utilized within the critical and production systems or environments (entity structure). | CCF: Use Of Non-Encrypted Protocols Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.16, 500.17 | Yes | Operations : Information | Include All Log Sources | 1222 |
CCF: Suspected Wireless Attack Alarm | This AIE Rule creates an event and alerts on suspected wireless attacks (success/failure) against the boundary monitoring devices. | CCF: Suspected Wireless Attack Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.16, 500.17 | Yes | Security : Attack | CCF: Wireless IDS | 1223 |
CCF: FIM Information | This AIE Rule creates events for general file integrity monitoring information. | N/A | 500.05, 500.06, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Operations : Information | Include All Log Sources | 1229 |
CCF: Abnormal Amount of Data Transferred | This rule alerts whenever a significant change (400% increase or 75% decrease) in Bytes In or Bytes Out from a specific host. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.13, 500.14, 500.15, 500.16, 500.17 | No | Operations : Warning | 1. Include All Log Sources 2. Include All Log Sources | 1230 |
CCF: Misuse | This AIE Rule provides details on misuse activity. | CCF: User Misuse Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Misuse | Include All Log Sources | 1231 |
CCF: Data Loss Prevention | This AIE Rule provides details of data generated by the LogRhythm Data Loss Defender or other data loss prevention solutions, when configured. | CCF: LogRhythm Data Loss Defender Log Inv | 500.05, 500.06, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Operations : Information | Include All Log Sources | 1232 |
CCF: FIM Abnormal Activity | This AIE Rule creates events for all abnormal file integrity monitoring activity. | N/A | 500.05, 500.06, 500.09, 500.13, 500.14, 500.15, 500.16, 500.17 | No | Security : Suspicious | 1. Include All Log Sources 2. Include All Log Sources | 1233 |
CCF: FIM Add Activity | This AIE Rule creates events for all file integrity monitoring add activity. | N/A | 500.05, 500.06, 500.09, 500.13, 500.14, 500.15, 500.16, 500.17 | No | Security : Activity | Include All Log Sources | 1234 |
CCF: FIM Delete Activity Alarm | This AIE Rule alarms on file integrity monitoring delete activity. | N/A | 500.05, 500.06, 500.09, 500.13, 500.14, 500.15, 500.16, 500.17 | Yes | Security : Activity | Include All Log Sources | 1235 |
CCF: Backup Failure Alarm | More than 10 backup failure events are detected. | CCF: Backup Activity Inv | 500.05, 500.06, 500.09, 500.13, 500.14, 500.15, 500.16, 500.17 | Yes | Operations : Error | Include All Log Sources | 1236 |
CCF: Backup Information | This AIE Rule creates events for information from backup software. | CCF: Backup Activity Inv | 500.05, 500.06, 500.09, 500.13, 500.14, 500.16, 500.17 | No | Operations : Information | Include All Log Sources | 1237 |
CCF: Early TLS/SSL Alarm | This AIE Rule alerts on the occurrence of any identified TLS LogRhythm Network Monitor event. | N/A | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.16, 500.17 | Yes | Security : Activity | Include All Log Sources | 1238 |
CCF: FIM General Activity | This rule creates an event fir file integrity monitoring activity including adds, deletes, modifies, group changes, owner changes, and permissions. The FIM log source can be established from LogRhythm's FIM or other FIM solutions. | N/A | 500.05, 500.06, 500.09, 500.13, 500.14, 500.15, 500.16, 500.17 | No | Operations : Information | Include All Log Sources | 1239 |
CCF: GeoIP General Activity | This rule is designed to use with the Data Processor's GeoIP functionality, to represent general GeoIP activity. | CCF: GeoIP Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Suspicious | Include All Log Sources | 1240 |
CCF: GeoIP Blacklisted Region Activity | This rule tracks activity associated with Blacklisted Regions (list). | CCF: GeoIP Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Suspicious | Include All Log Sources | 1241 |
CCF: Social Media Event | This rule tracks social media activity, to help identify if private or personal data that should not be in transmission is present within the environment's traffic. | CCF: Social Media Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Security : Suspicious | Include All Log Sources | 1242 |
CCF: Unknown User Account Alarm | This rule identifies activity originating from unknown user accounts, based off of the CCF user lists. | CCF: Unknown User Account Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | Yes | Security : Suspicious | Include All Log Sources | 1243 |
CCF: Windows RunAs Privilege Escalation | User not in the LogRhythm List "Privileged Users" chooses to Run a Windows program as an administrator using the "Run as administrator" option. | CCF: Privileged Account Escalation Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Suspicious | Include All Log Sources | 1321 |
CCF: Priv Group Access Granted Alarm | This AIE Rule provides details on access granted to privileged groups (administrators, dnsadmins, domain admins, enterprise admins, schema admins) within the organization infrastructure. | CCF: Privileged Account Modification Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | Yes | Audit: Access Granted | Include All Log Sources | 1324 |
CCF: Password Modified by Admin | Privileged user changes the password of another account. | CCF: Password Modified Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Suspicious | Include All Log Sources | 1325 |
CCF: Admin Password Modified | User changes the password of a different privileged user account. | CCF: Password Modified Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security: Suspicious | Include All Log Sources | 1326 |
CCF: Multiple Account Passwords Modified by Admin | An observed login by a user in the privileged user list followed by the change of two or more other account passwords. | CCF: Password Modified Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Security : Suspicious | Include All Log Sources | 1327 |
CCF: Audit Logging Stopped Alarm | This AIE Rule provides details on audit logging being stopped. | CCF: Audit Log Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.13, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Configuration | Include All Log Sources | 1328 |
CCF: Privilege Escalation After Attack Alarm | Compromised host event followed by a new account created or account modified on the same host. | CCF: Privileged Account Modification Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | Yes | Security : Suspicious | Include All Log Sources | 1329 |
CCF: Linux sudo Privilege Escalation | User not in the LogRhythm list "CCF: Privileged Accounts" and not in the local 'sudoers' file tries to use sudo on a Linux host. | CCF: Privileged Account Escalation Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Suspicious | Include All Log Sources | 1330 |
CCF: Audit Log Cleared Alarm | This AIE Rule provides details on audit log clearing. | CCF: Audit Log Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.13, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Access Success | Include All Log Sources | 1331 |
CCF: Failed Audit Log Write Alarm | This AIE Rule provides details on audit log write failures. | CCF: Audit Log Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.13, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Other Audit Failure | Include All Log Sources | 1332 |
CCF: Password Modified by Another User | User changes the password of another account (not their own). | CCF: Password Modified Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Audit: Account Modified | Include All Log Sources | 1333 |
CCF: Blacklisted Account Alarm | This AIE creates an alarm when a blacklisted account activity occurs within the environment. This requires the CCF: User Blacklist to be populated and updated regularly. | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Other Audit Success | Include All Log Sources | 1334 |
CCF: Compromise Detected Alarm | This AIE rule creates an event and alerts on potential compromises across the environment. | CCF: Compromises Detected Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.16, 500.17 | Yes | Security : Compromise | Include All Log Sources | 1335 |
CCF: Account Deleted Rule | This rule provides details of accounts that have been deleted | CCF: Deleted Account Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Audit : Account Deleted | Include All Log Sources | 1367 |
CCF: Account Enabled Rule | This AIE Rule alerts on the occurrence of any access granting to accounts. | CCF: Enabled Account Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Access Granted | Include All Log Sources | 1368 |
CCF: Account Disabled Rule | This AIE Rule alerts on the occurrence of any access revoking to accounts. | CCF: Disabled Account Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Audit : Access Revoked | Include All Log Sources | 1369 |
CCF: Account Modification | This AIE Rule creates a common event and provides detail around account modification activity. | CCF: Account Modification Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Audit : Account Modified | Include All Log Sources | 1377 |
CCF: Excessive Authentication Failures Rule | This AIE Rule supports alerting on >10 authentication failures in 30 minutes (login failures). Match this threshold to your organization's specific authentication failure policies. | CCF: Excessive Authentication Failure Inv | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Authentication Failure | Include All Log Sources | 1370 |
CCF: Software Install Rule | This AIE rule creates an event and alerts on any software installation activity across the environment. | N/A | 500.05, 500.06, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Audit : Configuration | Include All Log Sources | 1371 |
CCF: Software Uninstall Rule | This AIE rule creates an event and alerts on any software uninstallation activity across the environment. | N/A | 500.05, 500.06, 500.09, 500.14, 500.15, 500.16, 500.17 | No | Audit : Configuration | Include All Log Sources | 1372 |
CCF: Concurrent VPN from Same User | This AIE Rule alerts on the occurrence of concurrent VPN from the same user | N/A | 500.05, 500.06, 500.07, 500.09, 500.11, 500.14, 500.15, 500.16, 500.17 | No | Security : Compromise | Include All Log Sources | 1373 |
CCF: Software Uninstall Failure Alarm | This alerts on failed or interrupted software uninstallations. | N/A | 500.05, 500.06, 500.09, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Configuration | Include All Log Sources | 1374 |
CCF: Software Install Failure Alarm | This alerts on failed and incomplete updates attempts to update or install in the organization. | N/A | 500.05, 500.06, 500.09, 500.14, 500.15, 500.16, 500.17 | Yes | Audit : Configuration | Include All Log Sources | 1375 |
CCF: Denial Of Service Alert | This AIE Rule alerts on the occurrence of any identified Denial of Service event. | CCF: Denial of Service Inv | 500.05, 500.06, 500.07, 500.09, 500.14, 500.16, 500.17 | Yes | Security : Denial Of Service | Include All Log Sources | 1376 |