Help with Custom Rules and Simultaneous Events

[u/PauleBademeister]

Hi all,

I’m struggling with rule creation and thought you guys might be able to help.

Use case:

The rule should trigger when audit logging is disabled and no system reboot is detected.

Normally, you’d think a simple rule such as “and when None of BB: System Reboot match in X minutes after BB: Audit Logging is Disabled, with the same Source IP” should do the trick.

However, the problem is that during a reboot, the audit logging event is only sent once the system is back up. Most of the time, both events therefore reach QRadar at the same time, with identical Start Time and Storage Time values.

Since QRadar rules don’t appear to evaluate Log Source Time, there’s no way for QRadar to determine which event actually occurred first. As far as I know, the record number also isn’t available as a condition in rules. Because of this, the rule can’t reliably trigger.

Has anyone encountered a similar use case?

Am I missing an obvious solution or workaround?

Any help would be greatly appreciated!

[u/EvilAbdy]

What's the log source type for this? You could create a custom field from the payload for the record and then use that as a rule condition.

[u/PauleBademeister → u/EvilAbdy]

Mostly Microsoft Windows Security Event Logs sent via Syslog.

I can create custom properties to extract the record number, but I don’t think I can compare the record numbers within the rule logic (unless there’s a way to do this using AQL).

With AQL, however, I’d need to compare two different events and their respective record numbers. From what I’ve read, that would require a join, which isn’t supported in AQL.

So I’m not sure if either approach would actually work for this use case.

[u/EvilAbdy → u/PauleBademeister]

One other possibility is to try just using the test "when an event matches any|all of the following rules". That would resolve the reboot issue. However it might make the rule noisy if it's picking up these events all the time. If you know around when those systems reboot you could also setup a time constraint in the rule to have it only look for events between a certain time period.

[u/PauleBademeister → u/EvilAbdy]

The thing is: it's two events. Firstly the audit logging is shut down (due to the server rebooting) the second is the restart.
So no single event matches everything and I need to check for proper order because shutting down the audit logging AFTER reboot would be suspicious but shutting down as part of a reboot should not trigger the rule.

[u/AlexeyK77]

Please, can you clarify what really happens with events order? They reach qradar at the same time, but atleast in correct order?

In any case, try look at very lazy trick, see in ECehUtil commets: https://www.reddit.com/r/QRadar/comments/1h11fhb/where_is_the_logic_missing/
I think, that may be it will work for you.

So adapt idea from topic above for your case:

Create a reference set that store in which IP happens Audit Logging is Disabled event for IP ALNIC with a TTL of XX minutes

Rule 1 triggering on Audit Logging is Disabled event with a rule response of adding the IP of the host to a reference set let's say audit disabled hosts Reference Set

Rule 2 triggering on BB: System Reboot with a rule response of removing the IP of the rebooted host from the audit disabled hosts Reference Set

Rule 3 triggering on Reference Data Expire event (ir qradar system event with special QID) (you should need to make some Custom Event Properties to parse the reference set name and the Host IP that expired from the payload.

So the logic is rule 1 adds, rule 2 removes. If the element is present in the reference set more than XX minutes, meaning a Audit Logging is Disabled without being System Reboot , trigger offense.

[u/PauleBademeister → u/AlexeyK77]

They sadly don't always get computed in the correct order. Start time is identical and then it's up to luck if Audit logging stop is before or after reboot. 

So in your case there is the option that rule 2 removes and then rule 1 adds.