Newbie looking for a link or general guide that will help me tweak some of these alerts. One in particular:
Rule |
Rule Name: Ransomware detected on a host |
Remediation: |
Rule Description: Identifies excessive non-executable file changes by the same process on a Windows host. Requires Windows Security logs or FortiSIEM Agent to be running on the host. |
Seems to occur anytime a user copies a folder. Help!
Hi
This is the expected behaviour of a SIEM that has not been optimised towards a particular organisation.
The process would be as follows for optimising a SIEM:
1) Run weekly reports on Incidents that have a closure of False possitive sort by count
2) Review incident with highest count
3) Execute the Rule Pattern as a search query and gather the results
4) Review the logs that trigger the Rule
5) Review Rule Triggers
6) Optimise the Rule, either via exceptions or via cloning the rule and removing triggers.
7) Utilise Dynamic Watch lists within the rule to optimise further.
8) Execute the Rule Pattern as a search query verify outcome is correct.
S
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
