Investigating a Behavior Alert
When a behavior alert is triggered, more information is often needed in order to determine whether the alert is a real hit or a false positive. This is easy to do using the Fluency interface, as you are able to easily pivot between places to dig deep into an alert.
- v2 interface
- Classic v1 interface
First of all, behavior alerts can be viewed from Overview Summary in the navigation rail.
From here, you will be able to see each summary with its ALERT DATE, RISK score, and STATUS, the counts per severity in the SEVERITY BREAKDOWN tiles, and, with Sort on Highest risk first (the default), the riskiest summaries at the top. Click a severity tile, such as Critical, to list only that severity.
Taking the first summary as an example (a high risk score with a Critical severity), click it and it will open on the Behavior Summary page for that entity and day.
Note: you can also find summaries on Cases Search in the navigation rail, which searches all cases by text, time range, and filters; clicking a case opens its detail panel, whose Open case link opens the same page.
On the Behavior Summary page, Triggered Events lists every behavior rule this entity triggered that day, each with its Score, its Count of events, and a chip for each correlation alert it raised. Click a rule's row to expand it: Correlation Alerts says why each alert was raised (for example New Behavior (global), a behavior not seen before), and Fields lists the triggering event's fields, such as Application, Country, IPAddress, and OS for a sign-in.
Before investigating the raw events, check what the rule refers to: View Rule on the expanded row opens the behavior rule read-only (see Creating a Behavior Rule), so you can see what the rule looks for and which fields it records.
The fields a rule records are a selection. To get the original events behind this behavior, click Datalake Search on the expanded row, which searches the matching events in the data lake. On Datalake Search, click an event to open its detail panel, with every field of the event and its RAW JSON.
Then put the day in context. The Monthly Notable Event Statistics calendar below the triggered events shows the entity's other active days, each with its score and number of rules; click a day to load that day's summary. Compare this day's fields with those of the entity's other days: a value the entity has not shown before (flagged by the ML_NEW_USER alert in the example) is what raised the score. To list the entity's notable events one by one, search for the entity on Notable Events.
Once you have decided, record it with the status drop-down in the case header: Acknowledged while you work the case, or Closed, which adds a Classification drop-down for recording how it was resolved. Add Suppression on the expanded row starts a behavior filter for an alert you have found to be a false positive (see Behavior Filters).
The pivot controls this walkthrough relies on (clicking a record to open Behavior Summary, the magnifying-glass icons, the pencil edit icon), and the screenshots that show them, belong to the legacy interface; the paragraphs beginning "In the current interface" show the v1 pages. The pages themselves are all in the v1 menus: SIEM → Overview Summary, SIEM → Behavior Summary, SIEM → Behavior Timeline, SIEM → Behavior Rules, and Data Lake → Search. See Classic v1 interface for each page's v1 controls.
First of all, behavior alerts can be viewed from the Overview Summary option under the SIEM menu.
In the current interface that page looks like this:
From here, you will be able to see key information, including date, status, entity, key, behavior type, level and risk score.
Taking the first record as an example with a high risk score and a risk level of "Critical" assigned, click this record and it will navigate to Behavior Summary page.
In the current interface the Behavior Summary page presents one card per summary, each carrying the entity (username), the Day Index, the Status badge, the Score with its severity chip, and the Classification:
Note: You can also get to this page through the main menu like below, but it will show you all the behaviors.
On the Behavior Summary page, you can see all the triggered events from this entity. To the right of that are the corresponding risk scores, in addition to the number of events that triggered them.
You are going click the magnifying glass icon next to the name of "asset" (Or you can also click the icon next to each "triggered events", to see the specific triggered event under this asset). The magnifying glass icons allow you to pivot to the Behavior Timeline page and dig deeper into the occurrences associated with the behavior alert.
In the current interface the Behavior Timeline page plots the events on a risk-score chart and lists them newest first, each card carrying the entity, the Behavior rule it matched, its Score, and Alerts / Attributes toggle buttons:
Pivoting to the Behavior Timeline page allows you to view all the behavior model hits that occurred in relation to the key type, depending on which record did you chose from the Summary page and which magnifying glass icon did you click from the Behavior Summary page. In this case, you can see the query is filled in with both the "keyType" (asset) and the "key" (the name of asset) in the search bar. Each of these summary hits can be expanded to view all the field data associated with it.
Note: You can also get to this page through the main menu as below. This will show you all the behaviors, not limited to the specific key type mentioned above.
Expanding all the records on the Behavior Timeline page, you can see that there are still limited information given, such as EventID, Hostname, etc.. Some crucial information that you want to know are missing, such as IP address.
To get the initial syslogs of this bahavior model, you are going to pivot to the Events Search page (Data Lake → Search) using the magnifying glass by the behavior name. On the Events Search page, you'll see "@behaviors:"Bitdefender_Telemetry_UserLogOn" AND @bst.user_name:"Administrator"" are already filled in as the criterias of event search.
Click "search" botton to see the results.
In the current interface the Events Search page carries an index selector to the left of the query field, an Export Data and a Run Investigation button in the header, a facet panel down the left, and an event count timeline above the results:
Before investigating the syslog, go to the Behavior Rules page under SIEM and search for the specific behavior ("Bitdefender_Telemetry_UserLogOn", in this case) to see what it refers to.
In the current interface each rule is a card carrying its Name, Category, Tags, an Active toggle, and a three-dot (...) actions menu:
Click the pencil icon and continue to the third step "Activity Performed" (see Creating a Behavior Rule), then you can see this rule aims to give alerts for new logon, including the information of new user, IP, type and machine.
In the current interface the equivalent is the card's ... menu → View, which opens the Update Behavior Rule dialog, the same three-step wizard as Create Rule (Bucket Definition, Selection Criteria, Activity Performed), pre-filled with the selected rule.
Then go back to the previous Behavior Timeline page and check the new user/IP/type/machine, you can see the record that has high score represents a new user who is different from the regular record (lower), and that's why this event triggered the alert.
