Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cy 514 add the panel and alert for windows firewall status #341

Merged
merged 6 commits into from
Jul 27, 2023
Merged

Cy 514 add the panel and alert for windows firewall status #341

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ae6147e
CY-514: Added the alert for windows firewall status
hardikhdholariya Jul 12, 2023
24e9a9a
CY-514: Added the panel for windows firewall status
hardikhdholariya Jul 12, 2023
e27e202
CY-514: Updated the macro name
hardikhdholariya Jul 12, 2023
8e152ae
CY-514: Added the macro for firewall status logs and added the inline…
hardikhdholariya Jul 12, 2023
00c1bd8
CY-514: Updated as per the review comments
hardikhdholariya Jul 13, 2023
41721e8
Merge branch 'master' into CY-514-add-the-panel-and-alert-for-windows…
hardikhdholariya Jul 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions cyences_app_for_splunk/default/data/ui/views/cs_windows_reports.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,4 +152,34 @@
</html>
</panel>
</row>
<row>
<panel>
<title>Windows Firewall Status</title>
<table>
<search>
<query>`cs_windows_firewall_status_logs` host=$tkn_host|s$
| stats latest(_time) as "Time" latest(Domain_Profile_Status) as "Domain Profile Status" latest(Private_Profile_Status) as "Private Profile Status" latest(Public_Profile_Status) as "Public Profile Status" by host
| eval "Last Updated Time" = strftime(Time, "%+")
| rename host as Host
| table Host "Last Updated Time" "Domain Profile Status" "Private Profile Status" "Public Profile Status"</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Domain Profile Status">
<colorPalette type="map">{"ON": #03991a, "OFF": #a3030b}</colorPalette>
</format>
<format type="color" field="Public Profile Status">
<colorPalette type="map">{"ON": #03991a, "OFF": #a3030b}</colorPalette>
</format>
<format type="color" field="Private Profile Status">
<colorPalette type="map">{"ON": #03991a, "OFF": #a3030b}</colorPalette>
</format>
</table>
<html>
<p>This panel looks for the latest status of the firewall on each Windows host. Regardless of dashboard timerange, this panel search the data within 24 hours time-range.</p>
</html>
</panel>
</row>
</form>
8 changes: 8 additions & 0 deletions cyences_app_for_splunk/default/macros.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -596,6 +596,10 @@ iseval = 0
definition = `cs_windows_idx` sourcetype="*WinEventLog" source="*WinEventLog:System"
iseval = 0

[cs_windows_firewall_status_logs]
definition = `cs_windows_idx` sourcetype="WindowsFirewallStatus"
iseval = 0

[cs_ad_active_directory]
definition = `cs_windows_idx` sourcetype="ActiveDirectory"
iseval = 0
Expand Down Expand Up @@ -682,6 +686,10 @@ iseval = 0
definition = search *
iseval = 0

[cs_windows_firewall_is_disabled_filter]
definition = search *
iseval = 0


# Sysmon
[cs_sysmon]
Expand Down
42 changes: 41 additions & 1 deletion cyences_app_for_splunk/default/savedsearches.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -926,6 +926,46 @@ action.cyences_send_email_action = 1
action.cyences_notable_event_action.products = Sysmon


[Windows - Windows Firewall is Disabled]
disabled = 1
enableSched = 1
alert.track = 1
alert.severity = 4
alert.suppress = 0
counttype = number of events
quantity = 0
relation = greater than
# It will run every hour at minute 2 (savedsearch is scheduled 2 minutes delayed to capture the latest event which is generated every hour at minute 0).
cron_schedule = 2 * * * *
description = The alert will be triggered if the Windows Firewall has been disabled from its active state. The same alert will be suppressed if it triggers again on the same day. \
Data Collection - Windows Firewall Status Check Add-on (TODO: <Add the splunkbase link>).
# To Keep the current day as a suppression time, the earliest time is set to the current day's start time to generate the notable every day if the firewall is disabled.
dispatch.earliest_time = @d
dispatch.latest_time = now
display.general.type = statistics
display.page.search.tab = statistics
display.page.search.mode = fast
request.ui_dispatch_app = cyences_app_for_splunk
request.ui_dispatch_view = search
# The search captures the latest 2 events of every host and checks whether at least one Windows Firewall profile has been disabled from its active state. If this occurs, an alert will be triggered.
# Also, If an event with a firewall status disabled occurs for the first time in a day, an alert will be triggered.
search = `cs_windows_firewall_status_logs` \
| dedup 2 host \
| stats latest(Domain_Profile_Status) as Domain_Profile_Status latest(Private_Profile_Status) as Private_Profile_Status latest(Public_Profile_Status) as Public_Profile_Status earliest(Domain_Profile_Status) as Previous_Domain_Profile_Status earliest(Private_Profile_Status) as Previous_Private_Profile_Status earliest(Public_Profile_Status) as Previous_Public_Profile_Status count as event_count by host \
| eval changed = if((Previous_Domain_Profile_Status="ON" AND Domain_Profile_Status="OFF") OR (Previous_Private_Profile_Status="ON" AND Private_Profile_Status="OFF") OR (Previous_Public_Profile_Status="ON" AND Public_Profile_Status="OFF"), "Yes", "No") \
| search (changed = "Yes") OR ((event_count=1) AND (Domain_Profile_Status="OFF" OR Private_Profile_Status="OFF" OR Public_Profile_Status="OFF")) \
| eval cyences_severity = if(Public_Profile_Status="OFF" AND Private_Profile_Status="OFF" AND Domain_Profile_Status="OFF", "high", "medium") \
| table host Domain_Profile_Status Private_Profile_Status Public_Profile_Status cyences_severity \
| `cs_windows_firewall_is_disabled_filter`
action.cyences_notable_event_action = 1
action.cyences_notable_event_action.param.filter_macro_name = cs_windows_firewall_is_disabled_filter
action.cyences_notable_event_action.contributing_events = `cs_windows_firewall_status_logs`
action.cyences_notable_event_action.system_compromised_search = | stats count by host
action.cyences_notable_event_action.system_compromised_drilldown = `cs_windows_firewall_status_logs` host=$row.host$
action.cyences_send_email_action = 1
action.cyences_notable_event_action.products = Windows


[AD - Group Changed]
disabled = 1
enableSched = 1
Expand Down Expand Up @@ -2834,7 +2874,7 @@ counttype = number of events
quantity = 0
relation = greater than
cron_schedule = 7,22,37,52 * * * *
description = This alet will trigger when a Sophos endpoint service is no longer running. \
description = This alert will trigger when a Sophos endpoint service is no longer running. \
\
Data Collection - Sophos Central SIEM Integration Add-on (https://splunkbase.splunk.com/app/4647/) \
\
Expand Down
Loading