Lateral movement detection package #4833

sodhikirti07 · 2022-12-15T00:18:48Z

What does this PR do?

This PR adds Lateral movement detection assets to the integration packages list.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

[ ]

How to test this PR locally

Related issues and docs

elastic/security-ml#167
elastic/security-team#2933
https://docs.google.com/document/d/1aGB55YGVvIhMaa52uLr2CErTiifsRfb7gp2EZAJ1efQ/edit#heading=h.kgcaafk0hh1h
https://docs.google.com/document/d/14qliB7-hevPVNKX5SM1z6_gKhzVrbgb6G8wHZvMBNXs/edit

Screenshots

sodhikirti07 · 2022-12-15T00:24:27Z

Tested the package and following are some screenshots for the assets working as expected:

Package added as an integration

ML jobs installed and started successfully

Detection rules are successfully imported

elasticmachine · 2022-12-15T00:32:50Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2022-12-20T19:51:17.951+0000
Duration: 13 min 46 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

sodhikirti07 · 2022-12-15T15:26:47Z

I have kept the version of release as experimental based on the discussion I had with Jake yesterday. The idea is to release the package in technical review first to investigate if the rules create a lot of noise. This can be done by tracking the alerts telemetry. Please let me know your thoughts.

susan-shu-c · 2022-12-15T19:01:00Z

packages/lmd/manifest.yml

+conditions:
+  kibana.version: "^8.0.0"
+screenshots:
+  - src: /img/sample-screenshot.png


I think we don't need this placeholder Elastic logo screenshot anymore since we have any actual screenshot?

Yes, thanks for pointing it out. I meant to delete it earlier.

cla-checker-service · 2022-12-16T15:09:27Z

💚 CLA has been signed

szeitlin

suggested change - someone who knows more about product stuff should also review it and make sure it's ok to use direct instructions, rather than this very soft optional language that was there before.

packages/lmd/docs/README.md

Co-authored-by: Sam Zeitlin <samantha.zeitlin@elastic.co>

sodhikirti07 · 2022-12-16T17:59:49Z

@szeitlin Can we ask Sourin about this when he is back? Should we wait for his feedback?

szeitlin · 2022-12-16T18:49:13Z

@szeitlin Can we ask Sourin about this when he is back? Should we wait for his feedback?

I don't know that we want to wait that long. Maybe @approksiu or @MikePaquette can give us their expert opinion so we can get unblocked sooner?

ajosh0504

@sodhikirti07 Overall, looks great! 🥇

Left some suggestions. Could you also paste screenshots:

To show that the ML job module shows up as expected based on the query in the module json
To show that the ML module is installed successfully without errors
To show that runtime mappings are being added and working as expected
To show that rules are enabled without errors

packages/lmd/changelog.yml

packages/lmd/docs/README.md

packages/lmd/kibana/security_rule/2577e749-ed63-4b58-ac32-4f8a94d73e60.json

packages/lmd/kibana/security_rule/282cd7e6-9d51-421e-93b4-ebc2d422eb44.json

packages/lmd/kibana/security_rule/98789aa2-c22a-4ab4-aa6b-d980073f7ca7.json

packages/lmd/kibana/security_rule/e5ebb55f-97f0-4815-b05b-59b223b1d4df.json

packages/lmd/manifest.yml

packages/lmd/kibana/ml_module/lmd-ml.json

Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>

MikePaquette · 2022-12-19T17:07:51Z

suggested change - someone who knows more about product stuff should also review it and make sure it's ok to use direct instructions, rather than this very soft optional language that was there before.

I prefer the more direct language, but let's get the opinion of our tech documentation team, since they are experts in ensuring we use consistent style and language.

@jmikell821 can you or a member of your team review/edit the instructions mentioned above #4833 (review) ? Thanks in advance.

sodhikirti07 · 2022-12-19T17:18:58Z

Left some suggestions. Could you also paste screenshots:

To show that the ML job module shows up as expected based on the query in the module json
To show that the ML module is installed successfully without errors
To show that runtime mappings are being added and working as expected
To show that rules are enabled without errors

@ajosh0504 I think I've already covered the 1,2,4 screenshots here. Will do the screenshot of runtime mappings. Please let me know if you're implying something else here.

sodhikirti07 · 2022-12-19T19:32:20Z

ML module and jobs working properly:

Detection rules started without any warnings:

Mapping for file_directory working as expected in the datafeed

sodhikirti07 · 2022-12-19T21:30:34Z

@ajosh0504 made changes as suggested. Please have a look.

ajosh0504

Few more minor nits. Sorry! 😬

packages/lmd/kibana/security_rule/2577e749-ed63-4b58-ac32-4f8a94d73e60.json

packages/lmd/kibana/security_rule/282cd7e6-9d51-421e-93b4-ebc2d422eb44.json

packages/lmd/kibana/security_rule/98789aa2-c22a-4ab4-aa6b-d980073f7ca7.json

packages/lmd/kibana/security_rule/aa00d5db-7732-440a-97fc-8f9a3dc5314b.json

packages/lmd/kibana/security_rule/d4e891de-fe8d-4f19-a9b3-e5f390c7167e.json

packages/lmd/kibana/security_rule/e5ebb55f-97f0-4815-b05b-59b223b1d4df.json

approksiu · 2022-12-20T09:32:05Z

@szeitlin Can we ask Sourin about this when he is back? Should we wait for his feedback?

I don't know that we want to wait that long. Maybe @approksiu or @MikePaquette can give us their expert opinion so we can get unblocked sooner?

I like the strong language - I see that our users look up to us for recommendations how should they set things up. Let's also see what the docs team thinks.

ajosh0504

Awesome! 🚢

szeitlin · 2022-12-20T17:50:34Z

@sodhikirti07 do you know who/where to ask re: having the docs team review this?

benironside

Overall the README looks good. Made a couple of minor suggestions. No problems with the imperative language, that's standard for instructions.

packages/lmd/docs/README.md

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

sodhikirti07 · 2022-12-20T21:40:08Z

Shipping this package as experimental for 8.6. Below are a couple of things to do before moving it to ga in 8.7:

Add dashboard in the package spec
Attach a blog-post for lateral movement

elasticmachine · 2022-12-20T22:00:29Z

Package lmd - 0.0.1 containing this change is available at https://epr.elastic.co/search?package=lmd

CyberTaoFlow · 2022-12-30T21:08:18Z

seems like zeek and/or suricata SMB traffic could be useful for providing the network viewpoint independent of agent telemetry.
One point to consider is there will be a need to perform correlation with kerberos or ntlm logs from these same tools to obtain the user information used as an influencing attribute in the current jobs.

sodhikirti07 added 4 commits December 14, 2022 18:57

Lateral movement detection package

8bed94f

Added lmd to codeowners

308bbcd

Added lmd to codeowners

95f9c8a

Added lmd to codeowners

be4d764

sodhikirti07 requested review from szeitlin, susan-shu-c and ajosh0504 December 15, 2022 15:27

Changed detection rule setting

3d0be1b

susan-shu-c reviewed Dec 15, 2022

View reviewed changes

sodhikirti07 and others added 2 commits December 15, 2022 15:18

Removed elastic screenshot

bc62c0d

Changed description of enabling security rules

1e8178f

Changed readme.md

e6b9114

szeitlin approved these changes Dec 16, 2022

View reviewed changes

packages/lmd/docs/README.md Outdated Show resolved Hide resolved

Update packages/lmd/docs/README.md

0cd54bf

Co-authored-by: Sam Zeitlin <samantha.zeitlin@elastic.co>

ajosh0504 reviewed Dec 19, 2022

View reviewed changes

sodhikirti07 and others added 4 commits December 19, 2022 12:02

Update packages/lmd/changelog.yml

cecad95

Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>

Update packages/lmd/docs/README.md

659c800

Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>

Update packages/lmd/manifest.yml

808d335

Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>

Update packages/lmd/kibana/ml_module/lmd-ml.json

9fe0d52

Co-authored-by: Apoorva Joshi <30438249+ajosh0504@users.noreply.github.com>

sodhikirti07 added 3 commits December 19, 2022 14:23

Changed the names of detection rules

cb6d2f4

Updated security rule names

487cb2a

Changed ml module query

0e3661c

sodhikirti07 requested a review from ajosh0504 December 19, 2022 21:29

ajosh0504 suggested changes Dec 19, 2022

View reviewed changes

capitalized rule names

af019bf

sodhikirti07 requested a review from ajosh0504 December 20, 2022 14:24

ajosh0504 approved these changes Dec 20, 2022

View reviewed changes

benironside reviewed Dec 20, 2022

View reviewed changes

packages/lmd/docs/README.md Outdated Show resolved Hide resolved

packages/lmd/docs/README.md Outdated Show resolved Hide resolved

sodhikirti07 and others added 2 commits December 20, 2022 14:42

Update packages/lmd/docs/README.md

d61e714

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

Update packages/lmd/docs/README.md

d88a2fa

Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>

sodhikirti07 merged commit ee5b7a7 into main Dec 20, 2022

andrewkroh added Integration:lmd Lateral Movement Detection New Integration Issue or pull request for creating a new integration package. labels Aug 13, 2024

Lateral movement detection package #4833

Lateral movement detection package #4833

Uh oh!

Conversation

sodhikirti07 commented Dec 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Checklist

Author's Checklist

How to test this PR locally

Related issues and docs

Screenshots

Uh oh!

sodhikirti07 commented Dec 15, 2022

Uh oh!

elasticmachine commented Dec 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

🤖 GitHub comments

Uh oh!

sodhikirti07 commented Dec 15, 2022

Uh oh!

susan-shu-c Dec 15, 2022

Choose a reason for hiding this comment

Uh oh!

sodhikirti07 Dec 15, 2022

Choose a reason for hiding this comment

Uh oh!

cla-checker-service bot commented Dec 16, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

szeitlin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sodhikirti07 commented Dec 16, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

szeitlin commented Dec 16, 2022

Uh oh!

ajosh0504 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MikePaquette commented Dec 19, 2022

Uh oh!

sodhikirti07 commented Dec 19, 2022

Uh oh!

sodhikirti07 commented Dec 19, 2022

Uh oh!

sodhikirti07 commented Dec 19, 2022

Uh oh!

ajosh0504 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

approksiu commented Dec 20, 2022

Uh oh!

ajosh0504 left a comment

Choose a reason for hiding this comment

Uh oh!

szeitlin commented Dec 20, 2022

Uh oh!

benironside left a comment

Choose a reason for hiding this comment

sodhikirti07 commented Dec 15, 2022 •

edited

Loading

elasticmachine commented Dec 15, 2022 •

edited

Loading

cla-checker-service bot commented Dec 16, 2022 •

edited

Loading

sodhikirti07 commented Dec 16, 2022 •

edited

Loading