Elastic Defend and Network Security Alerts Correlation

  1[metadata]
  2creation_date = "2025/11/18"
  3integration = ["endpoint", "panw", "fortinet_fortigate", "suricata"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule correlate any Elastic Defend alert with a set of suspicious events from Network security devices like Palo Alto
 11Networks (PANW), Fortinet Fortigate and Suricata by host.ip and source.ip. This may indicate that this host is compromised and
 12triggering multi-datasource alerts.
 13"""
 14from = "now-60m"
 15interval = "10m"
 16language = "esql"
 17license = "Elastic License v2"
 18name = "Elastic Defend and Network Security Alerts Correlation"
 19risk_score = 73
 20rule_id = "0bca7e73-e1b5-4fb2-801b-9b5f5be20dfe"
 21setup = """## Setup
 22
 23This rule requires the `host.ip` field to be populated.
 24For **Elastic Defend** events on versions **8.18 and above**, this field is **disabled by default**.
 25
 26If you are using **Elastic Defend**, ensure host IP collection is enabled by following the configuration steps in the
 27[helper guide](https://www.elastic.co/docs/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint#host-fields).
 28"""
 29severity = "high"
 30tags = [
 31    "Use Case: Threat Detection",
 32    "Rule Type: Higher-Order Rule",
 33    "Resources: Investigation Guide",
 34    "Data Source: Elastic Defend",
 35    "Data Source: Fortinet",
 36    "Data Source: PAN-OS",
 37    "Data Source: Suricata",
 38    "Noise: Medium",
 39    "Performance: Slow",
 40    "Rule Type: ES|QL",
 41    "Domain: Network",
 42    "Domain: Endpoint",
 43]
 44timestamp_override = "event.ingested"
 45type = "esql"
 46
 47query = '''
 48FROM logs-* metadata _id
 49| WHERE
 50        // Elastic Defend Alerts
 51        (event.module == "endpoint" and data_stream.dataset == "endpoint.alerts") or
 52
 53        // PANW suspicious events
 54        (data_stream.dataset == "panw.panos" and
 55         event.action in ("virus_detected", "wildfire_virus_detected", "c2_communication", "spyware_detected", "large_upload", "denied", "exploit_detected")) or
 56
 57        // Fortigate suspicious events
 58        (data_stream.dataset == "fortinet_fortigate.log" and
 59         (event.action in ("outbreak-prevention", "infected", "blocked") or message like "backdoor*" or message like "Proxy*" or message like "anomaly*" or message like "P2P*" or message like "misc*" or message like "DNS.Over.HTTPS" or message like "Remote.Access")) or
 60
 61        // Suricata
 62        (data_stream.dataset == "suricata.eve" and message in ("Command and Control Traffic", "Potentially Bad Traffic", "A Network Trojan was detected", "Detection of a Network Scan", "Domain Observed Used for C2 Detected", "Malware Command and Control Activity Detected"))
 63
 64// extract source.ip from PANW, Fortigate or Suricata events and host.ip from Elastic Defend alert
 65|eval fw_alert_source_ip = CASE(data_stream.dataset in ("panw.panos", "fortinet_fortigate.log", "suricata.eve"), source.ip, null),
 66      elastic_defend_alert_host_ip = CASE(event.module == "endpoint" and data_stream.dataset == "endpoint.alerts", host.ip, null)
 67| eval Esql.source_ip = COALESCE(fw_alert_source_ip, elastic_defend_alert_host_ip)
 68| where Esql.source_ip is not null
 69
 70// group by host_source_ip shared between FG/PANW/Suricata and Elastic Defend
 71| stats Esql.alerts_count = COUNT(*),
 72        Esql.event_module_distinct_count = COUNT_DISTINCT(event.module),
 73        Esql.message_values_distinct_count = COUNT_DISTINCT(message),
 74        Esql.event_module_values = VALUES(event.module),
 75        Esql.message_values = VALUES(message),
 76        Esql.event_action_values = VALUES(event.action),
 77        Esql.process_executable_values = VALUES(process.executable),
 78        Esql.process_hash_sha256_values = VALUES(process.hash.sha256),
 79        Esql.process_cmdline_values = VALUES(process.command_line),
 80        Esql.file_path_values = VALUES(file.path),
 81        Esql.file_hash_sha256_values = VALUES(file.hash.sha256),
 82        Esql.host_id_values = VALUES(host.id),
 83        Esql.user_name_values = VALUES(user.name),
 84        Esql.destination_ip_values = VALUES(destination.ip)
 85        by Esql.source_ip
 86| where Esql.event_module_distinct_count >= 2 AND Esql.message_values_distinct_count >= 2
 87| eval concat_module_values = MV_CONCAT(Esql.event_module_values, ",")
 88// Make sure an endpoint alert is present along one of the network ones
 89| where concat_module_values like "*endpoint*"
 90
 91// Move single values to their corresponding ECS fields for alerts exclusion
 92| eval source.ip = mv_min(Esql.source_ip),
 93       host.id = mv_min(Esql.host_id_values),
 94       user.name = mv_min(Esql.user_name_values)
 95
 96| keep source.ip, host.id, user.name, Esql.*
 97'''
 98note = """## Triage and analysis
 99
100### Investigating Elastic Defend and Network Security Alerts Correlation
101
102This rule correlate any Elastic Defend alert with suspicious events from Network Security datasources like Palo Alto Networks (PANW), Fortinet Fortigate and Suricata by host.ip and source.ip.
103
104### Possible investigation steps
105
106- Review the alert details to identify the specific host and users involved.
107- Investiguate the network alerts by destination.ip and message.
108- Examine the timeline of the alerts to understand the sequence of events and determine if there is a pattern or progression in the tactics used.
109- Correlate the alert data with other logs and telemetry from the host, such as process creation, network connections, and file modifications, to gather additional context.
110- Check for any indicators of compromise (IOCs) associated with the alerts, such as suspicious IP addresses, domains, or file hashes, and search for these across the network.
111- Assess the impact and scope of the potential compromise by determining if other hosts or systems have similar alerts or related activity.
112
113### False positive analysis
114
115- IP address ranges overlap where the host.ip value from the Elastic Defend alert is unrelated to the source.ip value from the Network Security alert.
116- Alerts from routine administrative tasks may trigger multiple alerts. Review and exclude known benign activities such as scheduled software updates or system maintenance.
117- Security tools running on the host might generate alerts across different tactics. Identify and exclude alerts from trusted security applications to reduce noise.
118- Automated scripts or batch processes can mimic adversarial behavior. Analyze and whitelist these processes if they are verified as non-threatening.
119- Frequent alerts from development or testing environments can be misleading. Consider excluding these environments from the rule or applying a different risk score.
120- User behavior anomalies, such as accessing multiple systems or applications, might trigger alerts. Implement user behavior baselines to differentiate between normal and suspicious activities.
121
122### Response and remediation
123
124- Isolate the affected host from the network immediately to prevent further lateral movement by the adversary.
125- Conduct a thorough forensic analysis of the host to identify the specific vulnerabilities exploited and gather evidence of the attack phases involved.
126- Remove any identified malicious software or unauthorized access tools from the host, ensuring all persistence mechanisms are eradicated.
127- Apply security patches and updates to the host to address any exploited vulnerabilities and prevent similar attacks.
128- Restore the host from a known good backup if necessary, ensuring that the backup is free from compromise.
129- Monitor the host and network for any signs of re-infection or further suspicious activity, using enhanced logging and alerting based on the identified attack patterns.
130- Escalate the incident to the appropriate internal or external cybersecurity teams for further investigation and potential legal action if the attack is part of a larger campaign."""