Introduction
This article will provide information on using different queries to quickly progress event analysis during an event investigation in the incident management panel.
Logsign Response Query
When a case is created in the incident management panel, the findings related to the event are automatically collected and processed. In some cases, data analysis may require different queries instead of the existing findings, and in such cases, we can perform log analysis with Logsign Response's ready-made or custom queries.
To run a query, open the incident and click the action button in the bottom right corner of the page. In the Actions window, select the Logsign card, choose the device in the Device* field and the query in the Method* field, review the query field (it is filled with the incident's action column and object by default), then click Submit. In the Method* list, query names are shown in upper case with underscores (for example, DNS_ACTIVITIES).
The ready-made queries are as follows:
| Query | Method value | Description |
|---|---|---|
| R2L and L2R Firewall Connections | R2L_AND_L2R_FIREWALL_CONNECTIONS |
Retrieves network session logs (EventMap Context Network, Type Session), including firewall rule information. |
| Windows Host Allowed Connections | WINDOWS_HOST_ALLOWED_CONNECTIONS |
Retrieves allowed network connection logs from Windows hosts (Event IDs 5156 and Sysmon 3), including the process image. |
| Process Termination Activities | PROCESS_TERMINATION_ACTIVITIES |
Retrieves process termination logs (Event IDs 4689 and Sysmon 5). |
| DNS Activities | DNS_ACTIVITIES |
Retrieves the logs containing the domain address information that the DNS requested. |
| Registry Object Changes | REGISTRY_OBJECT_CHANGES |
Retrieves logs of registry changes (Event IDs 4657 and Sysmon 12, 13). |
| Kerberos Authentication Requests | KERBEROS_AUTHENTICATION_REQUESTS |
Retrieves Kerberos authentication logs (Event IDs 4768, 4769). |
| Failed Logon Activities | FAILED_LOGON_ACTIVITIES |
Retrieves failed logon logs. |
| Successful Logon Activities | SUCCESSFUL_LOGON_ACTIVITIES |
Retrieves successful logon logs. |
| Scheduler Task Activities | SCHEDULER_TASK_ACTIVITIES |
Retrieves logs of scheduled task activities. |
| Loaded Images Activities | LOADED_IMAGES_ACTIVITIES |
Retrieves logs about loaded DLL files (Sysmon Event ID 7). |
| Process Creations Activities | PROCESS_CREATIONS_ACTIVITIES |
Retrieves process creation logs (Event IDs 4688 and Sysmon 1), including the command line. |
| File Creation Activities | FILE_CREATION_ACTIVITIES |
Retrieves file creation logs. |
| File Deletion Activities | FILE_DELETION_ACTIVITIES |
Retrieves file deletion logs. |
| Outbound Firewall Traffic Activities | OUTBOUND_FIREWALL_TRAFFIC_ACTIVITIES |
Retrieves firewall logs of traffic from the internal network to external destinations. |
| Inbound Firewall Traffic Activities | INBOUND_FIREWALL_TRAFFIC_ACTIVITIES |
Retrieves firewall logs of traffic from external sources to the internal network. |
| Registry Value Set/Delete Activities | REGISTRY_VALUE_SET_ACTIVITIES |
Retrieves Sysmon registry value set and delete logs. |
| Registry Object Modified Activities | REGISTRY_OBJECT_MODIFIED_ACTIVITIES |
Retrieves logs of modified registry values. |
| Inbound Connection From Malicious IP Activities | INBOUND_CONNECTION_FROM_MALICIOUS_IP_ACTIVITIES |
Retrieves allowed inbound connections from IP addresses marked as malware by threat intelligence. |
| Firewall Attack Activities | FIREWALL_ATTACK_ACTIVITIES |
Retrieves attack detection logs from firewalls. |
| VPN Activities | VPN_ACTIVITIES |
Retrieves VPN logs. |
| Custom Query | CUSTOM_QUERY |
Returns logs with a custom query. The columns to display in the result table must be selected. |
Let's explain this situation with an example case. In the case below, it was observed that the T1059 MITRE scenario was executed on a server and traffic was directed towards the internet side. With the triggering of the alarm, blocking was done with the firewall, the associated user was disabled, and the user was removed from Logsign Security Automation from high-privilege groups.
When we check the findings, we see that the adminlgs user, the detected MITRE source, and the domain address it was trying to reach are available.
Let's investigate the event more deeply with Logsign response queries.
Let's examine the network activities between the server and the external source it accessed with a network connection query (for example, R2L_AND_L2R_FIREWALL_CONNECTIONS or WINDOWS_HOST_ALLOWED_CONNECTIONS).
We examined the start time of the first network activity, the used port information, and the destination IP information in the incoming logs.
We can also check for a reverse P2P connection.
We observed that there was no P2P connection within the 24-hour event time.