Introduction
This article explains how Logsign marks suspicious objects (for example IP addresses or user names) with list information, and how you can read these indicators in the Behavior and Context columns of alerts.
Context
Logsign uses a list structure for detecting abnormal behaviors. An object that satisfies certain conditions is added to the list. Lists are managed under Settings > Alerts & Incidents > Buckets. Each list can carry a Context value (Suspicious, Attacker, Victim or Vulnerability) that describes the objects in it.
Let's explain this with an example.
In the list below;
If a source IP address makes more than 100 post requests within 6 minutes, it will be added to the list. The Context value of this list is Suspicious.
When an alert rule under Settings > Alerts & Incidents > Alert Rules uses the Behavior match function to check a field (for example Source.IP) against this list, and the value is found in the list, Logsign adds the Context value of the list to the alert it generates. The column name is built from the field name without dots, so a check on Source.IP produces the Context.SourceIP column and a check on Destination.IP produces the Context.DestinationIP column.
As seen in the records below, the IP address in the Context.SourceIP and Context.DestinationIP columns has previously been added to a list with the Suspicious context.
Behavior
In the same way, columns such as Behavior.SourceIP or Behavior.SourceUserName are added to alerts whose rule uses the Behavior match function. The values in these columns are the names of the lists that contain the checked value. If the value is found in more than one list, all matching list names are shown.
Note that these columns are added while alert rules are evaluated. They appear on the alerts produced by those rules, not on every log that contains the same value.
In the example below, we can say that the IP address 192.168.250.184 is in the list of sources accessing a malicious IP address by looking at the Behavior.SourceIP column.