Essential SIEM Correlation Rules for Compliance

Technology has advanced considerably since the days when three incorrect login attempts were used to signal that a malicious actor had accessed your network.

Today, systems and networks, particularly commercial ones, gather enormous volumes of logs. In fact, we have encountered tools on multiple occasions whose log files consume substantially more storage than the software itself.

Because so much data is gathered, SIEM has advanced to a higher level and can greatly strengthen the security of networks and systems. Naturally, the SIEM correlation rules must be reasonable and effective, as no threat detection system is better than the logic that drives it.

Unified threat detection and cybersecurity could be the answer to your problems and you can You can start using it at no cost.

Let’s dive in and have a look at how SIEM correlation rules work, and how they are the backbone of any SIEM tool.

What is SIEM?

SIEM stands for Security Information and Event Management. Put simply, it represents an advancement in log collection and management. A SIEM that incorporates AI-powered event correlation uses the logs it collects to monitor the IT environment and help prevent harm to your system.

What is the definition of a Correlation Rule?

Correlation refers to a mathematical link between variables. It holds that if one thing happens to data one, another will happen to data 2. For instance, pressing the gas pedal makes your car accelerate. The relationship may be more complicated, but any two data sets with an identifiable relationship are considered correlated.

Data Aggregation and Normalization

Computer networks and systems consist of many types of hardware and software. Each one records and presents data in its own way. For the SIEM system to parse and handle log data effectively, logs from different applications need to be uniform. Normalization is the process of converting various log files into a standardized template.

Naturally, it is also important to collect data in one place, and this is called data aggregation. Having data in a single location is important because it makes processing and tracking everything faster and easier. If a system had to pull data logs from all over the network and analyze them each time it ran, it would be highly ineffective and bandwidth-intensive.

Common SIEM Correlation Rules

Correlation rules in SIEM systems can number in the hundreds and thousands. In fact, at Unified Security Stack our SIEM contains more than 128,000 correlation rules that are reviewed regularly. Some are simple, while others are more complex. Writing an article about every one of them would bore anyone, but here are a few of the most common correlation rules.

Once a correlation rule is triggered the system can take appropriate steps to mitigate all types of cyber-attacksTypically, this involves alerting a user and then perhaps restricting or even shutting down the system.

Brute Force Detection

Detecting brute force attacks is fairly simple. Brute forcing means repeatedly trying to guess a variable. In most cases, it refers to someone continually guessing your password, whether by hand or with a tool. But it can also mean guessing URLs or critical file locations on your system.

Automated brute force is easy to detect, since it is impossible for someone to enter their password 60 times in one minute.

Impossible Travel

Generally speaking, when a user logs in to a system, the system creates a timestamp for the event. In addition to the time, the system may often log other useful information, such as the device used, GPS address, IP address, incorrect login attempts, and so on. The more data that is collected, the more value can be obtained from it. For impossible travel, the system examines the current and previous login date and time along with the difference between the recorded distances. If it determines that the event could not have happened, such as traveling hundreds of miles in a minute, it will trigger a warning.

Unfortunately, many employees and users now use VPN services, so this should be taken into account when setting up such a rule.

Excessive File Copying

If you think about your day-to-day activities, you most likely do not copy or move around many files on your system. Therefore any excessive file copying on a system can be attributed to someone intending to cause harm to your company. Unfortunately, it is not as straightforward as saying that someone has illegally gained access to your network and wants to steal confidential information. It could also be an employee trying to sell company information, or they might simply want to take some files home for the weekend.

DDoS Attack

A DDoS (Distributed Denial of Service) attack would create a problem for nearly any company. A DDoS attack can not only take your web properties offline but also weaken your system. With the right correlation rules in place, your SIEM should raise an alert at the very start of the attack so you can take the necessary precautions to protect your systems.

File Integrity Change

File Integrity and Change Monitoring (FIM) is the practice of monitoring files on your system. Unexpected changes to your system files will trigger an alert, as they are a likely sign of a cyber attack.

Handling False Positives

Unfortunately, false positives occur in every walk of life, and the same is true for SIEM. Every tool and system can produce a false-positive result. For instance, too many failed login attempts may simply mean an employee forgot their password, not that someone is trying to break into the system. It is important that the steps taken for any triggered event are justifiable and proportionate, since you would not want employees locked out for hours in such situations.

Models

In addition to correlation rules, SIEM can also use models. Models are not exactly the same as correlation rules, yet when deployed properly they can be equally valuable. Rather than relying on a one-to-one correlation, a model needs multiple steps to occur before an alert is generated. Typically, this involves an initial rule followed by unusual activity. An example could be a user signing in from an unfamiliar location and then completing a large file transfer.

This is highly valuable because one event does not always indicate that an organization’s servers or network have been compromised; it may simply be a team member working from a cafe for a change of scenery.

How can I set up an alert rule in SIEM?

As mentioned, Unified Security Stack already has over 128,000 SIEM correlation rules to help with your cybersecurity. To maintain our system’s security and performance as much as possible, we do not permit users to add any new rules. If there are correlation rules or events you would like included, however, we can review them and put them in place as needed within a short time frame.

Other SIEM and security tools may let you add your own manually. For our customers, though, we do not consider this the correct protocol.

Importance for Complience

Having a great SIEM with solid correlation rules is extremely important for the compliance of different regulatory needs such as HIPAA, GDPR, GLBA, and SOC. In fact, with a unified threat management Unified Security Stack, you can satisfy several requirements established by these laws and gain peace of mind regarding your network security.

Conclusion

That covers it. We hope we have helped you understand SIEM correlation rules and their value for detecting threats and protecting your network. If you have not yet, we would suggest that you get Unified Security Stack to help protect you

Learn more about creating custom SIEM correlation rules here.

Learn how to reduce alert fatigue in your SIEM here.