Suricata and Elastic Defend Network Correlation

  1[metadata]
  2creation_date = "2025/12/10"
  3integration = ["endpoint", "suricata"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This detection correlates Suricata alerts with Elastic Defend network events to identify the source process performing
 11the network activity.
 12"""
 13from = "now-9m"
 14index = ["logs-endpoint.events.network-*", "filebeat-*", "logs-suricata.*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Suricata and Elastic Defend Network Correlation"
 18references = [
 19    "https://attack.mitre.org/tactics/TA0011/",
 20    "https://www.elastic.co/docs/reference/integrations/suricata",
 21    "https://www.elastic.co/docs/reference/integrations/endpoint"
 22]
 23risk_score = 47
 24rule_id = "9edd000e-cbd1-4d6a-be72-2197b5625a05"
 25severity = "medium"
 26tags = [
 27    "Domain: Endpoint",
 28    "Domain: Network",
 29    "OS: Linux",
 30    "OS: Windows",
 31    "OS: macOS",
 32    "Use Case: Threat Detection",
 33    "Tactic: Command and Control",
 34    "Data Source: Elastic Defend",
 35    "Data Source: Suricata",
 36    "Resources: Investigation Guide",
 37    "Noise: High",
 38    "Performance: Normal",
 39    "Profile: Aggressive",
 40    "Rule Type: Event Correlation (EQL)",
 41    "Platform: Windows",
 42    "Platform: Linux",
 43    "Platform: macOS",
 44]
 45type = "eql"
 46query = '''
 47sequence by source.port, source.ip, destination.ip with maxspan=5s
 48 [network where data_stream.dataset == "suricata.eve" and event.kind == "alert" and
 49  event.severity != 3 and source.ip != null and destination.ip != null and
 50  not rule.name in ("ET INFO SMB2 NT Create AndX Request For a Powershell .ps1 File", "ET SCAN MS Terminal Server Traffic on Non-standard Port")]
 51 [network where event.module == "endpoint" and event.action in ("disconnect_received", "connection_attempted") and
 52  not process.executable in ("System", "C:\\Program Files (x86)\\Admin Arsenal\\PDQ Inventory\\PDQInventoryService.exe") and 
 53  not process.executable : "C:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\service-*\\exec\\PDQInventoryScanner.exe"]
 54'''
 55note = """## Triage and analysis
 56
 57### Investigating Suricata and Elastic Defend Network Correlation
 58
 59### Possible investigation steps
 60
 61- Investigate in the Timeline feature the two events matching this correlation (Suricata and Elastic Defend).
 62- Review the process details like command_line, privileges, global relevance and reputation.
 63- Assess the destination.ip reputation and global relevance.
 64- Review the parent process execution details like command_line, global relevance and reputation.
 65- Examine all network connection details performed by the process during last 48h.
 66- Correlate the alert with other security events or logs to identify any patterns or additional indicators of compromise related to the same process or network activity.
 67
 68### False positive analysis
 69
 70- Trusted system or third party processes performing network activity that looks like beaconing.
 71
 72### Response and remediation
 73
 74- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
 75- Terminate the suspicious processes and all associated children and parents.
 76- Implement network-level controls to block traffic to the destination.ip.
 77- Conduct a thorough review of the system's configuration files to identify unauthorized changes.
 78- Reset credentials for any accounts associated with the source machine.
 79- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
 80"""
 81
 82[[rule.threat]]
 83framework = "MITRE ATT&CK"
 84
 85[[rule.threat.technique]]
 86id = "T1071"
 87name = "Application Layer Protocol"
 88reference = "https://attack.mitre.org/techniques/T1071/"
 89
 90[[rule.threat.technique]]
 91id = "T1571"
 92name = "Non-Standard Port"
 93reference = "https://attack.mitre.org/techniques/T1571/"
 94
 95[rule.threat.tactic]
 96id = "TA0011"
 97name = "Command and Control"
 98reference = "https://attack.mitre.org/tactics/TA0011/"
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102
103[[rule.threat.technique]]
104id = "T1046"
105name = "Network Service Discovery"
106reference = "https://attack.mitre.org/techniques/T1046/"
107
108[rule.threat.tactic]
109id = "TA0007"
110name = "Discovery"
111reference = "https://attack.mitre.org/tactics/TA0007/"