Statistical lists are lists that are linked to a condition.
For example, Brute Force Host, Port Scanners etc. You can use these lists when creating correlation rules.
To create one, go to Settings > Alerts & Incidents > Buckets, click the Bucket button and select Statistical as the type.
Statistics are used when repetitive incidents are expected to occur for a specific period of time. For example, Multiple Login Failures (@@LogonFailure: mini query of login failure on any device) occur 5 times in six minutes.
Description: The name of the list.
Type: Statistical
Group: The group the list belongs to (Behaviour, Intelligence, Asset or Other).
Severity: How important the list is for you: Emergency, Critical, Warning or Information. The default is Information.
Context: You can tag the object that enters this list as Suspicious, Attacker, Victim or Vulnerability for future events, or leave it as Not Set.
Query: The query whose results feed the list. In this example you use the @@LogonFailure mini query because you want to track unsuccessful login operations. If you tick Select Query From Report, you can copy the query of an existing report instead.
Time Column: The time field used for the calculation, either Time.Generated or Time.Received.
Group Column: The column by which events are grouped. In this example you set it to Source.UserName.
Value Column: The column whose values are counted for each group. Likewise, you set it to Source.UserName.
Criteria: How the values are calculated: Value Count, Unique Count or Value Sum. Value Sum can only be selected when the Value Column is numeric. In this example you choose Value Count to count the failed login attempts of each user.
Trigger Operator: The comparison applied to the Trigger Level: greater than (>), less than (<) or equal to (=). The default is >.
Trigger Level: The threshold that puts a group into the list. In this example, a user who has more than seven (7) unsuccessful login attempts enters the list. The default is 5.
Check events in last: The time window, in seconds, in which the events are evaluated. In this example it is seven hundred twenty (720) seconds. The default is 3600 seconds.
Update Period: How often, in seconds, the list is recalculated. The default is 60 seconds.
Purge Period: The number of seconds after which an entry is removed from the list. The default is 3600 seconds.
Then use the Save button to save your settings.
After creating your alarm list, you will have to create a rule based on the alerting. In this way Logsign Unified SecOps Platform will start to produce the alarms you need.
Using the Logsign Unified SecOps Platform web interface, go to Settings > Alerts & Incidents > Alert Rules, then click the Alert Rule button in the top right corner of the page.