DOCSEARCHbyAlgolia
Submit Docs

Chronicle Detection Rules

repository·main·Indexed 19 days ago

https://github.com/chronicle/detection-rules

A collection of example YARA-L detection rules and dashboard templates for Google Security Operations (SecOps). Includes community rules, SOC Prime Threat Detection Marketplace rules, and specialized SAP and HANA DB detections. The repository also provides automation tools such as rule_manager and Content Manager to implement Detection-as-Code pipelines via the Google SecOps REST API, along with GitHub Actions workflows for rule validation and synchronization.

Tokens
11.8K
Snippets
19
Records
37
Agent score
68%

What's inside chronicle-detection-rules

  1. Overview of Content Manager for Google SecOps

    main

    Content Manager is a command-line tool designed to manage Google SecOps content, enabling a 'Detection-as-Code' workflow. It can be integrated into CI/CD pipelines (GitHub, GitLab, CircleCI, etc.) or run locally using Application Default Credentials (ADC).

    Key capabilities include:

    • YARA-L Validation: Verify rule validity without creating or evaluating them against data.
    • Rule Management: Retrieve current rules/configurations to local .yaral files, and update Google SecOps by creating new rules, updating versions, or changing rule states (enable/disable/archive).
    • Data Table Management: Sync data tables between local files and Google SecOps.
    • Reference List Management: Sync reference lists between local files and Google SecOps.
    • Exclusion Management: Manage rule exclusions via local configuration files.
    • Saved Search Management: Manage saved searches via local configuration files.

  3. Understand the repository directory structure

    main

    The repository is organized into two main functional areas:

    DirectoryDescription
    rules/community/YARA-L rules created by the Google SecOps team and the user community
    tools/content_manager/A CLI tool used to manage rules and other content via the Google SecOps REST API
    tools/rule_manager/A tool for implementing Detection-as-Code pipelines via the REST API

  4. Manage Google SecOps rules and reference lists via GitHub Actions

    main

    You can use example GitHub Actions workflow files to automate the management of YARA-L rules and reference lists through the Google SecOps REST API. The available workflows allow you to:

    • Run Tests: Execute unit tests and verify the syntax/logic of YARA-L rules using the Google SecOps API.
    • Pull Latest Content: Synchronize your GitHub repository with Google SecOps by pulling the latest versions of all rules and reference lists and committing them to your repo.
    • Update Remote Content: Push local rule file changes to Google SecOps to update the remote rules and reference lists.

  5. Use the `match` section to group related alerts

    main

    The match section is used to group related events into a single detection.

    Important Note on NULL values: Match variables automatically exclude NULL values (empty strings "" or 0 for integers) unless the allow_zero_values option is explicitly set. Do not add redundant conditions in the events section to check for non-empty values if they are being used in a match section.

  6. Understand the SOC Prime rule organization structure

    main

    SOC Prime rules are organized into a two-tier hierarchy to help users locate specific detections:

    1. Use case category: The top-level directory for each rule. Categories include:

      • Proactive Exploit Detection: Rules containing "CVE" or "exploit" in the body or tags.
      • Active Directory Security: Rules related to Azure Active Directory (AD).
      • Cloud Security: Rules involving IaaS, SaaS, or PaaS data sources, or mentioning Cloud products.
      • Threat Hunting: Rules related to Threat Hunting and tagged with "APT".
      • Compliance: Rules covering Compliance security controls.
      • IOC Sigma: Rules belonging to Indicators of Compromise (IOCs), including IOC Sigma rules.
      • Mixed / Other: Rules that do not fit the above categories.

    2. Log sources: Within each use case category, rules are further organized into subfolders based on the original Sigma rule log source.

  8. Import Dashboards into Google SecOps

    main

    The repository contains YAML files that can be used as templates or starting points for Google SecOps dashboards. To import them:

    1. Locate the dashboard YAML file in the repository.
    2. In the Google SecOps UI, navigate to the Personal Dashboards or Shared Dashboards section.
    3. Click the Add button and select Import Dashboard to upload the file.

  9. How to customize and import SAP Data Tables

    main

    The SAP detection rules rely on Data Tables to identify sensitive entities. You must customize the provided sample CSV files with values specific to your SAP landscape before importing them.

    Customization Steps

    1. Modify CSVs: Edit the provided .csv files in the data_tables/ directory to include your organization's specific sensitive roles, users, or programs.
    2. Import to Google SecOps:
      • Navigate to Detection > Data Tables.
      • Create a new Data Table and upload your customized CSV file.
    3. Match Names: Ensure the Data Table name in Google SecOps matches the name referenced in the YARAL rules (e.g., sap_sensitive_roles).

    Implementation Standards

    • Case Sensitivity: All entries in your CSV files must be in UPPERCASE. SAP logs store User IDs, Roles, and Programs in uppercase; using lowercase will cause detections to fail.
    • Maintenance: Review and update these lists quarterly or after major SAP transport cycles that introduce new Z programs or roles.

  11. Manage data tables in Google SecOps

    main

    The Content Manager provides commands to synchronize data tables between your local environment and Google SecOps. Data tables are managed using .csv files for content and a data_table_config.yaml file for metadata.

    Retrieve data tables

    Use data-tables get to pull the latest version of all data tables from Google SecOps. This command writes the table contents to the data_tables directory as .csv files and updates data_table_config.yaml with the configuration and metadata.

    Update data tables

    Use data-tables update to push local changes to Google SecOps. This command can:

    • Create new data tables.
    • Replace the contents of existing tables.
    • Update descriptions or row time-to-live (TTL) values.

    Note: Ensure your local .csv files and data_table_config.yaml follow the expected format. An entry in data_table_config.yaml defines columns, their indices, and types (e.g., STRING).

    Delete data tables

    Use data-tables delete to remove tables from Google SecOps.

    Warning: This is a destructive, non-reversible action. Back up your data before proceeding. Deletion will fail if the data table is currently referenced by a rule.

    # Retrieve all data tables
python -m content_manager data-tables get

# Update data tables from local files
python -m content_manager data-tables update

# Delete data tables (requires --scope)
python -m content_manager data-tables delete --scope [all|unmanaged]

  12. Use Google Security Operations Community Rules

    main

    The Community Rules directory contains detection rules created by the Google SecOps team and the Google Cloud Security Community. These rules are written using YARA-L syntax.

    Important Usage Warning: The detection logic in many of these rules is intentionally broad. It is strongly discouraged to enable all community rules in Google Security Operations without performing careful review, testing, and customization to match your organization's specific environment and detection use cases.