nxlog*


Unauthorized Cron Job Creation

Log Source: /var/log/syslog, /var/log/cron
MITRE ID: T1053.003

Question: SourceName.keyword : "CRON"

Question: SourceName.keyword : "CRON"

Question: "SourceName.keyword": *

Question: "Severity.keyword": *

Question: "Message.keyword": *

Question: "Hostname.keyword": *

nxlog*

Suspicious Sudo Command Usage

Log Source: /var/log/auth.log
MITRE ID: T1548.003

Question: "SourceName": "sudo"

Question: "SourceName": "sudo"

Question: "Hostname.keyword": *

Question: "Message.keyword": *

Question: "Severity.keyword": *

Question: "SourceName.keyword": *

nxlog*

Access to `/etc/shadow`

OS Credential Dumping |T1003.008 |https://attack.mitre.org/techniques/T1003/008/

Question: Message.keyword : *shadow*

Question: Message.keyword : *shadow*

Question: "Hostname.keyword": *

Question: "Message.keyword": *

Question: "SourceName.keyword": *

Question: "Severity.keyword": *

nxlog*

Count of CRON events over time

Question: SourceName.keyword: "CRON"

Question: SourceName.keyword: "CRON"

nxlog*

Count of sudo Command over time

Question: "SourceName": "sudo"

Empty XY chart

Question: "SourceName": "sudo"

nxlog*

Count of New User and Group Creation

Question: SourceName.keyword: "userdel"   or  SourceName.keyword: "groupadd"

Empty XY chart

Question: SourceName.keyword: "userdel"   or  SourceName.keyword: "groupadd"

nxlog*

Count of Script Execution from /tmp

Question: Message.keyword: * /tmp/*

Empty XY chart

Question: Message.keyword: * /tmp/*

nxlog*

Question: SourceName.keyword: "CRON"

Question: SourceName.keyword: "CRON"

nxlog*

Question: "SourceName": "sudo"

Question: "SourceName": "sudo"

nxlog*

Question: SourceName.keyword: "userdel"   or  SourceName.keyword: "groupadd"

Question: SourceName.keyword: "userdel"   or  SourceName.keyword: "groupadd"

nxlog*

Question: Message.keyword: * /tmp/*

Question: Message.keyword: * /tmp/*

New User and Group Creation

T1136.001 – New User and Group Creation

Question: SourceName.keyword: "userdel"   or  SourceName.keyword: "groupadd"

Question: SourceName.keyword: "userdel"   or  SourceName.keyword: "groupadd"

Question: "Hostname.keyword": *

Question: "Message.keyword": *

Question: "Severity.keyword": *

Question: "SourceName.keyword": *

nxlog*

Script Execution from /tmp

T1059.004 – Command and Scripting Interpreter: Unix Shell
Detects execution of scripts or staging of data from /tmp, a common location for attacker activity.

Question: Message.keyword: * /tmp/*

Question: Message.keyword: * /tmp/*

Question: "Message.keyword": *

Question: "Hostname.keyword": *

Question: "SourceName.keyword": *

Question: "Severity.keyword": *

nxlog*

Access to `/etc/shadow`

Question: Message.keyword : *shadow*

Empty XY chart

Question: Message.keyword : *shadow*

nxlog*

Question: Message.keyword : *shadow*

Question: Message.keyword : *shadow*

Linux Security monitoring


Group Membership Changes

Question: EventID : (4728 or 4729 or 4732 or 4733 or 4735 or 4737)

Question: EventID : (4728 or 4729 or 4732 or 4733 or 4735 or 4737)

Unique count of LogFileCleared.SubjectUserName.keyword

Top 5 values of LogFileCleared.SubjectUserName.keyword

Top 3 values of TargetOutboundUserName.keyword

Group Policy Changes

Question: EventID : (4739 or 5136)

Empty XY chart

Question: EventID : (4739 or 5136)

Unique count of LogFileCleared.SubjectDomainName.keyword

Top 3 values of LogFileCleared.SubjectUserName.keyword

Unique count of SubjectDomainName.keyword

USB Activity

6416 or 6424)

Question: EventID : (6416 or 6424)

Question: EventID : (6416 or 6424)

NPS Authentication

(6272 or 6273 or 6274)

Question: EventID : (6272 or 6273 or 6274)

Empty XY chart

Question: EventID : (6272 or 6273 or 6274)

nxlog*

WMI Execution

EventID : (5857 or 5858)

Question: EventID : (5857 or 5858)

Question: EventID : (5857 or 5858)

Question: EventID : (400 or 4102 or 4103 or 4104 or 4105 or 4106)

Question: EventID : (400 or 4102 or 4103 or 4104 or 4105 or 4106)

nxlog*

PowerShell Execution Events

PowerShell Execution Events (EventIDs 400, 4102–4106) – MITRE T1059.001

Question: EventID : (400 or 4102 or 4103 or 4104 or 4105 or 4106)

Question: EventID : (400 or 4102 or 4103 or 4104 or 4105 or 4106)

Question: "EventID": *

Question: "Hostname.keyword": *

Question: "Severity.keyword": *

Question: "AccountName.keyword": *

Question: "ScriptBlockText.keyword": *

Question: "Message.keyword": *

Question: "ScriptBlockId.keyword": *

nxlog*

Question: EventID : (4624 or 4625 or 4648)

Question: EventID : (4624 or 4625 or 4648)

nxlog*

Process Creation

(EventID 4688) – MITRE T1059 / T1204.002

Question: EventID : 4688

Question: EventID : 4688

Question: "Hostname.keyword": *

Question: "SubjectUserName.keyword": *

Question: "SubjectDomainName.keyword": *

Question: "NewProcessName.keyword": *

Question: "TokenElevationTypeResolved.keyword": *

Question: "MandatoryLabelName.keyword": *

Question: "EventID": *

Question: "Channel.keyword": *

Question: "NewProcessName.keyword": *

nxlog*

Question: EventID : 4688

Question: EventID : 4688

nxlog*

Service Abuse

Question: EventID : (4697 or 7045)

Question: EventID : (4697 or 7045)

Question: "ServiceFileName.keyword": *

Question: "ServiceAccount.keyword": *

Question: "ServiceStartType": *

Question: "ServiceType.keyword": *

Question: "Category.keyword": *

Question: "ExecutionProcessID": *

Question: "EventType.keyword": *

Question: "ClientProcessId": *

Question: "EventID": *

nxlog*

Question: EventID : (4697 or 7045)

Question: EventID : (4697 or 7045)

nxlog*

Question: EventID : 4699

Question: EventID : 4699

nxlog*

Question: EventID: 4700

Question: EventID: 4700

Question: EventID: 4701

Question: EventID: 4701

Question: EventID: 4702

Question: EventID: 4702

nxlog*

Question: EventID: 4672

Question: EventID: 4672

Special privileges assigned to new logon

nxlog*

Question: EventID: 4673

Question: EventID: 4673

Question: EventID: 4964

Question: EventID: 4964

Special groups have been assigned to a new logon

Scheduled Task Ops

EventID >= 4698 and EventID <= 4702

Question: EventID >= 4698 and EventID <= 4702

Question: EventID >= 4698 and EventID <= 4702

Question: "EventID": *

Question: "Hostname.keyword": *

Question: "EventType.keyword": *

Question: "SubjectUserSidName.keyword": *

Question: "SubjectUserName.keyword": *

Question: "SubjectDomainName.keyword": *

Question: "TaskName.keyword": *

Question: "ClientProcessId": *

nxlog*

Privilege Escalation

EventID : (4672 or 4673 or 4964)

Question: EventID : (4672 or 4673 or 4964)

Question: EventID : (4672 or 4673 or 4964)

Question: "EventID": *

Question: "EventType.keyword": *

Question: "Hostname.keyword": *

Question: "SubjectUserSid.keyword": *

Question: "SubjectUserName.keyword": *

Question: "SubjectDomainName.keyword": *

Question: "SubjectLogonId.keyword": *

Question: "Category.keyword": *

nxlog*

Question: EventID : 4625

Question: EventID : 4625

Question: EventID : 4624

Question: EventID : 4624

nxlog*

Question: EventID :4648

Question: EventID :4648

A logon was attempted using explicit credentials

Authentication

(4624 or 4625 or 4648)

Question: EventID : (4624 or 4625 or 4648)

Question: EventID : (4624 or 4625 or 4648)

Question: "LogonType": *

Question: "TargetUserName.keyword": *

Question: "TargetDomainName.keyword": *

Question: "TargetUserSidName.keyword": *

Question: "SubjectUserSid.keyword": *

Question: "LogonProcessName.keyword": *

Question: "AuthenticationPackageName.keyword": *

Question: "ElevatedToken.keyword": *

Question: "VirtualAccount.keyword": *

Question: "ImpersonationLevel.keyword": *

Question: "EventID": *

nxlog*

Question: EventID : 1102

Question: EventID : 1102

Audit Log Cleared

Security Log Cleared – EventID 1102 (T1070.001)"

Question: Hanye

Question: EventID : 1102

Question: EventID : 1102

Question: Hanye

Question: "Message.keyword": *

Question: "Hostname.keyword": *

Question: "EventID": *

Question: "LogFileCleared.SubjectDomainName.keyword": *

Question: "LogFileCleared.SubjectLogonId.keyword": *

Question: "LogFileCleared.SubjectUserSidName.keyword": *

Question: "LogFileCleared.ClientProcessId": *

nxlog*

Windows Security Monitoring


.kibana-event-log-*

.kibana-event-log-*


Time slider

Rule type

Kibana space

This dashboard helps you monitor the health and performance of detection rules.
- You need at least `read` privileges for the `.kibana-event-log-*` index to access the necessary data.
- This Kibana-managed dashboard can not be customized. To make a custom version, clone it or edit and save it as a new dashboard.

Enabled rules

Question: alerting

Question: execute

Question: siem

Number of rules that were executed during the selected timeframe.

Question: alerting

Question: execute

Question: siem

Number of rule executions within the selected timeframe.

Rule executions

Question: securitySolution.ruleExecution

Question: status-change

Question: succeeded

Number of rule executions with a succeeded status (outcome of the rule execution) within the selected timeframe.

"Succeeded" statuses

Question: securitySolution.ruleExecution

Question: status-change

Question: partial failure

Number of rule executions with a warning status (outcome of the rule execution) within the selected timeframe.

"Warning" statuses

Question: securitySolution.ruleExecution

Question: status-change

Question: failed

Number of rule executions with a failed status (outcome of the rule execution) within the selected timeframe.

"Failed" statuses

Question: alerting

Question: execute

Question: siem

Histogram where each column shows a number of rule executions broken down by rule type.

Executions by rule type

Question: securitySolution.ruleExecution

Question: status-change

Question: running

Question: kibana.alert.rule.execution.status: "succeeded"

Question: kibana.alert.rule.execution.status: "partial failure"

Question: kibana.alert.rule.execution.status: "failed"

Histogram where each column shows a number of rule executions broken down by rule status (outcome of the rule execution).

Executions by status

**Total rule execution duration** shows how much time it took for a rule to run from the very start to the very end.

Question: alerting

Question: execute

Question: siem

This chart aggregates this metric across all rules and shows how a few important percentiles of the metric were changing over time. 99th percentile means that 99% of rule executions had a total duration less than the percentile's value.

Total rule execution duration, percentiles

Question: alerting

Question: execute

Question: siem

Total rule execution duration, top 5 rules per @timestamp

**Rule schedule delay** shows the difference between the planned rule start time (according to its schedule) and the time when it actually started. Normally, it should be about 3 seconds or less. When the cluster is overloaded, it can be way more than 3 seconds. This is when you'd want to scale your cluster according to the load or reduce it by disabling or optimizing the rules.

Question: alerting

Question: execute

Question: siem

divide

percentile(kibana.task.schedule_delay, percentile=99) / 1000000

percentile(kibana.task.schedule_delay, percentile=95) / 1000000

percentile(kibana.task.schedule_delay, percentile=50) / 1000000

This chart aggregates this metric across all rules and shows how a few important percentiles of the metric were changing over time. 99th percentile means that 99% of rule executions had a schedule delay less than the percentile's value.

Rule scheduling delay, percentiles

Question: alerting

Question: execute

Question: siem

max(kibana.task.schedule_delay) / 1000000

Rule scheduling delay, top 5 rules per @timestamp

**Search/query duration** metric shows how much time it took for a rule when it was executing to query source indices (or data views) to find source events matching the rule's criteria.

Question: securitySolution.ruleExecution

Question: execution-metrics

Question: kibana.alert.rule.execution.metrics.total_run_duration_ms: *

This chart aggregates this metric across all rules and shows how a few important percentiles of the metric were changing over time. 99th percentile means that 99% of rule executions had a search/query duration less than the percentile's value.

Search/query duration, percentiles

Question: securitySolution.ruleExecution

Question: execution-metrics

Search/query duration, top 5 rules per @timestamp

**Indexing duration** metric shows how much time it took for a rule when it was executing to write generated alerts to the `.alerts-security.alerts-*` index.

Question: securitySolution.ruleExecution

Question: execution-metrics

Question: kibana.alert.rule.execution.metrics.total_run_duration_ms: *

This chart aggregates this metric across all rules and shows how a few important percentiles of the metric were changing over time. 99th percentile means that 99% of rule executions had an indexing duration less than the percentile's value.

Indexing duration, percentiles

Question: securitySolution.ruleExecution

Question: execution-metrics

Indexing duration, top 5 rules per @timestamp

Top 10 rules by various criteria.

Question: alerting

Question: execute

Question: siem

Top 10 slowest rules by total execution duration

Question: alerting

Question: execute

Question: siem

Top 10 slowest rules by schedule delay

Question: securitySolution.ruleExecution

Question: status-change

Question: failed

Top 10 rules by status "Failed"

Question: securitySolution.ruleExecution

Question: status-change

Question: partial failure

Top 10 rules by status "Warning"

[Elastic Security] Detection rule monitoring