• Support
  • Forums
  • Blogs

Alarm Rule Using ==>

SherlockSherlock

New Life Form
Hello All,
I am having alot of problems finishing an alarm rule to fire when a user uses okta to login from two different countries in a short period of time. I am basing the rule off of this Correlation Rule. 

app_name == 'office-365' AND event_name IN('UserLoggedIn', 'MailboxLogin') AND source_country!= '' AND source_username >> [user] ANDsource_country ==> |countries|

And this is what I have currently.

(packet_type == 'log' AND app_name == 'okta' AND event_name in ('Login success') AND source_country != '' AND source_username >> [user] AND source_country == '[var_source_country]')
As you can see I have it all set except for the last operator ==>. 

From the documentation I know ==> Checks the value against a list filled with previous events values. Will validate the condition if the element is not already included in the list. Im sure its relatively simple issue but I am having a hell of a time getting it to work. Any help would be greatly appreciated.

Share post:

Best Answer

Answers

  • For rules pertaining to origin test using the source_countries in place of source_country 

    Example below Is for any source connection from outside ireland Alarm will fire
    (packet_type == 'log' AND app_name == 'okta' AND event_name == 'Login success' AND alarm_source_countries != 'ireland')

    Additional Example event source is not from Ireland and a username is captured for traffic from italy. 
    (packet_type == 'log' AND app_name == 'okta' AND event_name == 'Login success' AND alarm_source_countries != 'ireland' ANDsource_username == 'mary' AND alarm_source_countries == 'italy')


  • @Sherlock

    Correction to above..  source_country is correct and current syntax. 
    (packet_type == 'log' AND event_name == 'Login - Successful Login' AND source_country != 'ireland' AND source_username == 'mary')

    This had changed. Setting a time window will not be an option at this time but we have requested internally to review this intelligence requirement. 

    Sherlock
  • You cannot use "Ireland" or "America" or "China" or Canada".

      Per the documentation we have publicly available, you must use ISO-3166 to specify country-code. For example, you would use "IE" for Ireland, "US" for America, "CN" for China, "CA" for Canada, etc. 

      
       ISO-3166 is expressed in our "Filter Rules" documentation :: 


       Regards,

    - kratos 

       
    Sherlock
  • @Kratos @dpeterson

    Thanks for your response. I confirmed this with support and I have put in a feature request. Would be a nice feature to have for sure.
This discussion has been closed.