Debugging Rules on FortiSIEM

[sioannou]

Hi all, 

Just checking if someone is aware of a method for debugging SIEM rules when they trigger. 

We have been through the testing, replay logs in a controlled environment and testing variations of the matching conditions but in production we still see the rule being triggered while the conditions match only one of the Multiple Subpattern Rules and the rule triggers (Note: The multiple subpatterns NEXT operator is bonded with AND/AND_NOT). We see the logs all arriving within the specified time window but we still get the trigger. 

Is anyone aware of a debug command or a way we can debug the rule in actual production environment. We have checked phoenix.log in both glassfish and /opt/phoenix/ but it is only informational that the rule has triggered, no details on the conditions. 

My fear is that this is a race condition issue. 

Thanks,

Sotiris 

[Goutham_FTNT]

Hi Sotiris,

Do you find this issue on any specific version ?
Noticed only for customer rules ?
There is a way you can check the subpattern match before enabling the rule . You can go to Resource > Rules > Edit the rule > Define Condition > Edit the subpattern > Run as Query (Provide the time range)  - This should return only matching conditions , check if you find the same behavior where the you get results for OR instead of AND

You can also enable DEBUG for phRuleWorker and phRuleMaster (phtools --change-log phRuleWorker DEBUG ; phtools --change-log phRuleMaster DEBUG) - After capturing the logs please make sure you put the log level to INFO (Same command replace DEBUG to INFO)

If you get the same behavior on the queries as well then need to deep dive

Regards,

Goutham 

[sioannou]

Hi Goutham, 

Thank you for your response, yes we have tried the Run as Query and the behaviour is as expected. I will ask the team to try the debug option in the lab and let you know. 

Regards, 

Sotiris

[cdurkin_FTNT]

Can you provide the rule and sanitized sample raw events?

[sioannou]

Hi, 

We have raised a support request. In discussion with the support team at FTN. 

Thanks,

Sotiris