Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Tuning] event.action and event.type change #3495

Merged
merged 3 commits into from
Mar 13, 2024
Merged

[Tuning] event.action and event.type change #3495

merged 3 commits into from
Mar 13, 2024

Conversation

Aegrah
Copy link
Contributor

@Aegrah Aegrah commented Mar 8, 2024

Summary

This PR changes the sequence of the event.action and event.type, to increase query performance.

@Aegrah Aegrah self-assigned this Mar 8, 2024
@botelastic botelastic bot added the bbr Building Block Rules label Mar 8, 2024
@Aegrah Aegrah mentioned this pull request Mar 8, 2024
Closed
@terrancedejesus
Copy link
Collaborator

@Aegrah I noticed you mentioned this is related to performance increases, but do we have benchmarks or testing to confirm these changes will increase performance?

@w0rk3r
Copy link
Contributor

w0rk3r commented Mar 9, 2024 •
edited

@terrancedejesus, this relates to our discussion while reviewing one of Ruben's PRs in EAH. Filtering for event.type first reduces the size of the dataset, and filtering for event.action and then event.type doesn't make sense as it will always have the same value.

@Aegrah
Copy link
Contributor Author

Aegrah commented Mar 11, 2024

@terrancedejesus exactly what @w0rk3r said. We discussed whether we would remove the event.type == "start" from the queries entirely; but concluded that reducing the query sample to all start events before continuing the rest of the query would likely see benefits, and having the event.type == "start" in the query does provide readibility.

w0rk3r
w0rk3r approved these changes Mar 11, 2024
View reviewed changes
Copy link
Contributor

@w0rk3r w0rk3r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🙇🏼‍♂️

terrancedejesus
terrancedejesus approved these changes Mar 12, 2024
View reviewed changes
Copy link
Collaborator

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Aegrah @w0rk3r - Thank you for taking the time to remind me of our conversation 😅

@Aegrah Aegrah merged commit 9f8638a into main Mar 13, 2024
14 checks passed
@Aegrah Aegrah deleted the linux-event-type-tuning branch March 13, 2024 09:11
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
fac550f 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml
- rules/linux/discovery_esxi_software_via_find.toml
- rules/linux/discovery_esxi_software_via_grep.toml
- rules/linux/discovery_kernel_module_enumeration.toml
- rules/linux/discovery_process_capabilities.toml
- rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/collection_linux_suspicious_clipboard_activity.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
50af23d 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml
- rules/linux/discovery_esxi_software_via_find.toml
- rules/linux/discovery_esxi_software_via_grep.toml
- rules/linux/discovery_kernel_module_enumeration.toml
- rules/linux/discovery_process_capabilities.toml
- rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/collection_linux_suspicious_clipboard_activity.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
547a820 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/discovery_kernel_module_enumeration.toml
- rules/linux/discovery_process_capabilities.toml
- rules/linux/execution_curl_cve_2023_38545_heap_overflow.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/collection_linux_suspicious_clipboard_activity.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
b641223 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/discovery_process_capabilities.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
78a48a4 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/discovery_process_capabilities.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
b64f44b 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/discovery_process_capabilities.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
6be3acb 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/discovery_process_capabilities.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
578e86e 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

Removed changes from:
- rules/linux/discovery_process_capabilities.toml
- rules/linux/privilege_escalation_enlightenment_window_manager.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml
- rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml
- rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml
- rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml
- rules_building_block/discovery_capnetraw_capability.toml
- rules_building_block/persistence_cap_sys_admin_added_to_new_binary.toml

(selectively cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
1116860 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
4896c37 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 9f8638a)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@Aegrah @github-actions
[Tuning] event.action and event.type change (#3495)
3b5b0c4 
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit 9f8638a)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@w0rk3r w0rk3r w0rk3r approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

Assignees

@Aegrah Aegrah

Labels
Area: RAD backport: auto bbr Building Block Rules Domain: Endpoint OS: Linux Rule: Tuning tweaking or tuning an existing rule Team: TRADE
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@Aegrah @terrancedejesus @w0rk3r