Alert Rules

[V1dal9]

Hello!
I'm facing a problem when configuring rules in UTMStack. According to the documentation, I created a rule and it was triggered correctly the first time I inserted it. However, when I try to repeat the process, i.e. trigger that same rule again, it is not working, i.e. it does not issue an alert.

Details of the problem:

• The rule works once after being configured.
• When I try to trigger it again, the rule is not triggered.
• I've reviewed the documentation and settings, but the problem persists.

Additional information:

• UTMStack version in use: 10.5.14;
• Steps to reproduce the problem:

1. Creation of the rule (following the documentation), creating a custom folder.
2. First execution of the rule (works correctly).
3. Attempt to trigger the rule again (does not trigger).

I would like to know if there is any additional procedure to ensure that the rules are triggered correctly in subsequent executions or if there is some kind of limitation or bug that is preventing this.

Rule

• name: "Detect Explorer.exe Process Creation Cache"
  severity: "Medium"
  description: "An instance of explorer.exe has been created."
  solution: "Review the process creation and ensure it is legitimate."
  category: "Process Creation"
  tactic: "Execution"
  dataTypes: ["wineventlog"]
  reference:
  • "https://attack.mitre.org/techniques/T1059/001/"
    frequency: 1
    cache:
  • allOf:
    • field: "logx.wineventlog.event_id"
      operator: "=="
      value: 4688 # Event ID for process creation
    • field: "logx.wineventlog.event_data.NewProcessName"
      operator: "contains"
      value: "explorer.exe"
      timeLapse: 3600
      minCount: 1
      save:
    • field: "logx.wineventlog.event_data.TargetUserName"
      alias: "SourceUser"
    • field: "logx.wineventlog.host.name"
      alias: "SourceHost"
    • field: "logx.wineventlog.event_data.NewProcessId"
      alias: "ProcessID"
    • field: "logx.wineventlog.event_data.ParentProcessName"
      alias: "ParentProcessName"

[c3s4rfred]

Hi, @V1dal9, that is the correct behavior, please check the @osmontero's answer on this discussion -> https://github.com/orgs/utmstack/discussions/817, there he give some explanations of the correlation rules. If your rule saved fields doesn't change their value, the rule won't be triggered again within 24 h, the logs will be grouped in the same rule.

Best regards