Use case Creation

[Abhirup_10]

Hi Everyone,

I want to create a new Use case to detect Suspicious activity on insecure ports from remote to local and local to remote. I didn't understand how do I write the query as source IP/Destination IP as remote. Is there any way to define the "Context" like Remote and Local? 

I want to define for L2R rule destination IP should be remote and for R2L Source IP should be Remote. I have tried with the reverse condition but it didn't worked properly. 


Example: For L2R I have mentioned all the Local IP network segment as not category (Source IP!= 10.0.0.0/8) and for R2L vice versa (Destination IP!=10.0.0.0/8).   

Can anyone help me with this please? 

[mattymo]

This would heavily depend on what your events look like as you would simply extract fields that represent "remote" and "local" fields. 

Got an example event?