📝 Пример правила корреляции: Brute Force Detection
rule "SSH_Brute_Force_Attack" {
events:
$failed = count(
Event(
event_id == 4625 OR event_id == 5156,
service == "ssh",
action == "failed"
)
) >= 5
within:
5 minutes
group by:
source_ip, destination_ip
condition:
$failed AND
NOT source_ip in whitelist_ips
action:
alert(
severity: "HIGH",
category: "Brute Force",
description: "Multiple failed SSH attempts detected"
)
block_ip(source_ip, duration: 1h)
}