Do I tune the use-case search itself or modify the Threat Intelligence datamodel?

[oylkm]

I have a few Threat Intelligence data that have Use-Cases applied to them but I'm trying to filter out blocked events, for example - say an asset was attempting to communicate with a malicious site and it was blocked by the proxy or firewall. Do I tune the use-case search itself or modify the Threat Intelligence datamodel?

All suggestions are appreciated. 

[oylkm]

Hi @gcusello ,

Thanks for the feedback, let me post an example of the search I'm attempting to modify or maybe in another case modify the datamodel. 

| from datamodel:"Threat_Intelligence"."Threat_Activity" OR index=netfilter action=*

| search NOT [| inputlookup org_local_intel_whitelist.csv | fields threat_collection_key, dest

    |  table threat_collection_key, dest

    | format "(" "(" "OR" ")" "OR" ")" ]  

| dedup threat_match_field,threat_match_value | `get_event_id` | table _raw,event_id,source,src,dest,threat*,weight, orig_sourcetype | rename weight as record_weight

 | `per_panel_filter("ppf_threat_activity","threat_match_field,threat_match_value")` | `get_threat_attribution(threat_key)` | rename source_* as threat_source_*,description as threat_description

 | eval risk_score=case(isnum(record_weight), record_weight, isnum(weight), weight, 1=1, null())

 | fields - *time | eval risk_object_type=case(threat_match_field="query" OR threat_match_field=="src" OR threat_match_field=="dest","system",threat_match_field=="src_user" OR threat_match_field=="user","user",1=1,"other")

| eval risk_object=threat_match_value

 | dedup dest | eval urgency=if(threat_category=="MISP", "medium" , "high")

I want to modify this search to look at an index and if the action is "blocked" then don't send an alert but if the action is "allowed" then write that into the threat index for alerting. 

[gcusello]

Hi @oylkm,

I suppose that you're speaking about ES.

Anyway in some projects I customized both Datamodels and Use cases, it depends on the customization:

if the difference is only a new field to add to theDataModel to use in search the DataModel customization is the quicker way, otherwise you could clone and modify a Use Case (never modify the original Use Case!).

Speaking about Threat Intelligence, maybe you should modify not the Threat Intelligence Datamodel, but the scheduled search used to populate the DataModel, But it isn't a job so easy and you need a deep knowledge about ES in general and threat Intelligence DataModel in deep!

Ciao.

Giuseppe