METRON-685 Scores in Threat Triage should be a Stellar Statement #1311

nickwallen · 2018-12-20T22:32:56Z

Allows a threat triage rule's score to be expressed as either a numeric value or a Stellar expression.

The change is backwards compatible. Users will not have to alter their existing triage rules.
The 'score' expression has access to all of the fields contained within the message being triaged.

Testing

Create a threat triage engine.

[Stellar]>>> t := THREAT_TRIAGE_INIT()
[Stellar]>>> t
ThreatTriage{0 rule(s)}

Add a triage rule that uses a simple numeric score. This is the existing behavior that continues to be supported.
```
[Stellar]>>> THREAT_TRIAGE_ADD(t, {"name":"rule1", "rule":"value>10", "score":10})
```
Add another triage rule that uses a score expression. This will simply make the score 10 times the value contained in the message.
```
[Stellar]>>> THREAT_TRIAGE_ADD(t, {"name":"rule2", "rule":"value>20", "score":"value*10"})
```

Review the rules that you have created.

[Stellar]>>> THREAT_TRIAGE_PRINT(t)
╔═══════╤═════════╤═════════════╤══════════╤════════╗
║ Name  │ Comment │ Triage Rule │ Score    │ Reason ║
╠═══════╪═════════╪═════════════╪══════════╪════════╣
║ rule1 │         │ value>10    │ 10       │        ║
╟───────┼─────────┼─────────────┼──────────┼────────╢
║ rule2 │         │ value>20    │ value*10 │        ║
╚═══════╧═════════╧═════════════╧══════════╧════════╝

Create a few test messages to simulate your telemetry.

[Stellar]>>> msg1 := "{ \"value\":22 }"
[Stellar]>>> msg1
{ "value":22 }

[Stellar]>>> msg2 := "{ \"value\":44 }"
[Stellar]>>> msg2
{ "value":44 }

Score a message based on the rules that have been defined. The result allows you to see the total score, the aggregator, along with details about each rule that fired.

[Stellar]>>> THREAT_TRIAGE_SCORE( msg1, t)
{score=220.0, aggregator=MAX, rules=[{score=10, name=rule1, rule=value>10}, {score=value*10, name=rule2, rule=value>20}]}

[Stellar]>>> THREAT_TRIAGE_SCORE( msg2, t)
{score=440.0, aggregator=MAX, rules=[{score=10, name=rule1, rule=value>10}, {score=value*10, name=rule2, rule=value>20}]}

Pull Request Checklist

Is there a JIRA ticket associated with this PR? If not one needs to be created at Metron Jira.
Does your PR title start with METRON-XXXX where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
Has your PR been rebased against the latest commit within the target branch (typically master)?
Have you included steps to reproduce the behavior or problem that is being changed or addressed?
Have you included steps or a guide to how the change may be verified and tested manually?
Have you ensured that the full suite of tests and checks have been executed in the root metron folder via
Have you written or updated unit tests and or integration tests to verify your changes?
If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
Have you verified the basic functionality of the build by building and running locally with Vagrant full-dev environment or the equivalent?

ottobackwards · 2018-12-21T16:33:59Z

@nickwallen, i just did a clean checkout of your pr ( in tmp dir, not my repo ), and did vagrant up which worked.
When I try to run stellar, is see this:

[vagrant@node1 ~]$ cd /usr/metron/0.7.0/bin/
[vagrant@node1 bin]$ ./stellar
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/usr/metron/0.7.0/lib/metron-profiler-repl-0.7.0.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/usr/hdp/2.6.5.0-292/hadoop/lib/slf4j-log4j12-1.7.10.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.slf4j.impl.Log4jLoggerFactory]
Exception in thread "main" java.lang.NoClassDefFoundError: oi/thekraken/grok/api/exception/GrokException
	at java.lang.Class.getDeclaredConstructors0(Native Method)
	at java.lang.Class.privateGetDeclaredConstructors(Class.java:2671)
	at java.lang.Class.getConstructor0(Class.java:3075)
	at java.lang.Class.getConstructor(Class.java:1825)
	at org.apache.metron.stellar.dsl.functions.resolver.BaseFunctionResolver.createFunction(BaseFunctionResolver.java:238)
	at org.apache.metron.stellar.dsl.functions.resolver.BaseFunctionResolver.resolveFunction(BaseFunctionResolver.java:192)
	at org.apache.metron.stellar.dsl.functions.resolver.BaseFunctionResolver.resolveFunctions(BaseFunctionResolver.java:164)
	at org.apache.metron.guava.base.Suppliers$MemoizingSupplier.get(Suppliers.java:125)
	at org.apache.metron.stellar.dsl.functions.resolver.BaseFunctionResolver.getFunctionInfo(BaseFunctionResolver.java:84)
	at org.apache.metron.stellar.common.shell.DefaultStellarShellExecutor.init(DefaultStellarShellExecutor.java:177)
	at org.apache.metron.stellar.common.shell.cli.StellarShell.createExecutor(StellarShell.java:268)
	at org.apache.metron.stellar.common.shell.cli.StellarShell.<init>(StellarShell.java:154)
	at org.apache.metron.stellar.common.shell.cli.StellarShell.main(StellarShell.java:115)
Caused by: java.lang.ClassNotFoundException: oi.thekraken.grok.api.exception.GrokException
	at java.net.URLClassLoader.findClass(URLClassLoader.java:382)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:349)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
	... 13 more

ottobackwards · 2018-12-21T16:35:07Z

How are you running it

nickwallen · 2018-12-21T16:36:26Z

I spun it up in Full Dev from my feature branch. No libraries or dependencies changed, so maybe this is something that is already in master. I'll take a look.

nickwallen · 2018-12-21T16:39:35Z

Usually I run as root in Full Dev. Any difference if you start stellar as 'root'?

ottobackwards · 2018-12-21T16:39:52Z

let me try

ottobackwards · 2018-12-21T16:42:24Z

same issue running as root using sudo su - to get there

nickwallen · 2018-12-21T16:44:02Z

I'll spin it up again and try to replicate. Thanks for giving it a go.

ottobackwards · 2018-12-21T16:46:41Z

I don't know how grok came into this.

nickwallen · 2018-12-21T18:13:32Z

Yes, this is an issue in master. I opened a JIRA and am working on a fix.

Glad you found that.

ottobackwards · 2018-12-28T20:21:49Z

@nickwallen stellar is still crashing for me. You changed the metron-common script, but https://github.com/apache/metron/tree/master/metron-stellar/stellar-common/src/main/scripts/deployed is the script I think you need to change. I'm pretty sure I verified your first fix, and then you made the parsers->parsing change after.

I'm going to test after manually changing the stellar file.

ottobackwards · 2018-12-28T20:26:53Z

After making the changes, everything works as described in the steps. I'll try to do a code review.

ottobackwards · 2018-12-28T22:16:37Z

In the code, if find the use of score to be confusing. Sometimes it is a String, sometimes it is a number. Can we disambiguate this?

nickwallen · 2018-12-29T20:56:29Z

Hi @ottobackwards, I will need to merge master into this PR to take advantage of #1312. I am traveling right now, but will do so when I return.

Since #1312 was merged I am assuming this is no longer a problem in master. Let me know if that is incorrect.

@ottobackwards

…edback from @ottobackwards

nickwallen · 2019-01-07T18:13:26Z

@ottobackwards I addressed your feedback. Ran it up again and re-tested just to be sure.

[root@node1 0.7.0]# cat triage-test.stellar
t := THREAT_TRIAGE_INIT()
THREAT_TRIAGE_ADD(t, {"name":"rule1", "rule":"value>10", "score":10})
THREAT_TRIAGE_ADD(t, {"name":"rule2", "rule":"value>20", "score":"value*10"})
THREAT_TRIAGE_PRINT(t)
msg1 := "{ \"value\":22 }"
msg2 := "{ \"value\":44 }"
THREAT_TRIAGE_SCORE( msg1, t)
THREAT_TRIAGE_SCORE( msg2, t)

[root@node1 0.7.0]# cat triage-test.stellar | bin/stellar
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/usr/metron/0.7.0/lib/metron-profiler-repl-0.7.0.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/usr/hdp/2.6.5.0-292/hadoop/lib/slf4j-log4j12-1.7.10.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.slf4j.impl.Log4jLoggerFactory]
Stellar, Go!
Functions are loading lazily in the background and will be unavailable until loaded fully.
{}
[Stellar]>>> t := THREAT_TRIAGE_INIT()
ThreatTriage{0 rule(s)}
[Stellar]>>> THREAT_TRIAGE_ADD(t, {"name":"rule1", "rule":"value>10", "score":10})
{
  "enrichment" : {
    "fieldMap" : { },
    "fieldToTypeMap" : { },
    "config" : { }
  },
  "threatIntel" : {
    "fieldMap" : { },
    "fieldToTypeMap" : { },
    "config" : { },
    "triageConfig" : {
      "riskLevelRules" : [ {
        "name" : "rule1",
        "rule" : "value>10",
        "score" : "10"
      } ],
      "aggregator" : "MAX",
      "aggregationConfig" : { }
    }
  },
  "configuration" : { }
}
[Stellar]>>> THREAT_TRIAGE_ADD(t, {"name":"rule2", "rule":"value>20", "score":"value*10"})
{
  "enrichment" : {
    "fieldMap" : { },
    "fieldToTypeMap" : { },
    "config" : { }
  },
  "threatIntel" : {
    "fieldMap" : { },
    "fieldToTypeMap" : { },
    "config" : { },
    "triageConfig" : {
      "riskLevelRules" : [ {
        "name" : "rule1",
        "rule" : "value>10",
        "score" : "10"
      }, {
        "name" : "rule2",
        "rule" : "value>20",
        "score" : "value*10"
      } ],
      "aggregator" : "MAX",
      "aggregationConfig" : { }
    }
  },
  "configuration" : { }
}
[Stellar]>>> THREAT_TRIAGE_PRINT(t)
╔═══════╤═════════╤═════════════╤══════════╤════════╗
║ Name  │ Comment │ Triage Rule │ Score    │ Reason ║
╠═══════╪═════════╪═════════════╪══════════╪════════╣
║ rule1 │         │ value>10    │ 10       │        ║
╟───────┼─────────┼─────────────┼──────────┼────────╢
║ rule2 │         │ value>20    │ value*10 │        ║
╚═══════╧═════════╧═════════════╧══════════╧════════╝
Aggregation: MAX
[Stellar]>>> msg1 := "{ \"value\":22 }"
{ "value":22 }
[Stellar]>>> msg2 := "{ \"value\":44 }"
{ "value":44 }
[Stellar]>>> THREAT_TRIAGE_SCORE( msg1, t)
{score=220.0, aggregator=MAX, rules=[{score=10, name=rule1, rule=value>10}, {score=value*10, name=rule2, rule=value>20}]}
[Stellar]>>> THREAT_TRIAGE_SCORE( msg2, t)
{score=440.0, aggregator=MAX, rules=[{score=10, name=rule1, rule=value>10}, {score=value*10, name=rule2, rule=value>20}]}
[Stellar]>>>
[Stellar]>>>

ottobackwards

This is great work @nickwallen +1

…kwallen) closes apache#1311

nickwallen added 3 commits December 20, 2018 15:51

METRON-685 Scores in Threat Triage should be a Stellar statement

aa6e4c5

Merge remote-tracking branch 'apache/master' into METRON-685

88ec5cc

Updated README docs

651eaf5

ottobackwards self-requested a review December 28, 2018 20:27

nickwallen added 2 commits January 7, 2019 10:30

Merge remote-tracking branch 'apache/master' into METRON-685

6d75e6a

Rename RiskLevelRule.score to scoreExpression for clarity based on fe…

53678a7

…edback from @ottobackwards

ottobackwards approved these changes Jan 7, 2019

View reviewed changes

asfgit closed this in 39fa0f1 Jan 7, 2019

JonZeolla pushed a commit to JonZeolla/metron that referenced this pull request Jan 24, 2019

METRON-685 Scores in Threat Triage should be a Stellar Statement (nic…

104aedb

…kwallen) closes apache#1311

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

METRON-685 Scores in Threat Triage should be a Stellar Statement #1311

METRON-685 Scores in Threat Triage should be a Stellar Statement #1311

nickwallen commented Dec 20, 2018 •

edited

Loading

ottobackwards commented Dec 21, 2018

ottobackwards commented Dec 21, 2018

nickwallen commented Dec 21, 2018 •

edited

Loading

nickwallen commented Dec 21, 2018

ottobackwards commented Dec 21, 2018

ottobackwards commented Dec 21, 2018 •

edited

Loading

nickwallen commented Dec 21, 2018

ottobackwards commented Dec 21, 2018

nickwallen commented Dec 21, 2018 •

edited

Loading

ottobackwards commented Dec 28, 2018

ottobackwards commented Dec 28, 2018

ottobackwards commented Dec 28, 2018

nickwallen commented Dec 29, 2018 •

edited

Loading

nickwallen commented Jan 7, 2019

ottobackwards left a comment

METRON-685 Scores in Threat Triage should be a Stellar Statement #1311

METRON-685 Scores in Threat Triage should be a Stellar Statement #1311

Conversation

nickwallen commented Dec 20, 2018 • edited Loading

Testing

Pull Request Checklist

ottobackwards commented Dec 21, 2018

ottobackwards commented Dec 21, 2018

nickwallen commented Dec 21, 2018 • edited Loading

nickwallen commented Dec 21, 2018

ottobackwards commented Dec 21, 2018

ottobackwards commented Dec 21, 2018 • edited Loading

nickwallen commented Dec 21, 2018

ottobackwards commented Dec 21, 2018

nickwallen commented Dec 21, 2018 • edited Loading

ottobackwards commented Dec 28, 2018

ottobackwards commented Dec 28, 2018

ottobackwards commented Dec 28, 2018

nickwallen commented Dec 29, 2018 • edited Loading

nickwallen commented Jan 7, 2019

ottobackwards left a comment

Choose a reason for hiding this comment

nickwallen commented Dec 20, 2018 •

edited

Loading

nickwallen commented Dec 21, 2018 •

edited

Loading

ottobackwards commented Dec 21, 2018 •

edited

Loading

nickwallen commented Dec 21, 2018 •

edited

Loading

nickwallen commented Dec 29, 2018 •

edited

Loading