Correlated Alerts on Similar User Identities

  1[metadata]
  2creation_date = "2026/02/12"
  3maturity = "production"
  4min_stack_comments = "ES|QL COMPLETION and INLINE STATS require Elastic Stack 9.3.0 or later."
  5min_stack_version = "9.3.0"
  6updated_date = "2026/09/25"
  7
  8[rule]
  9author = ["Elastic"]
 10description = """
 11This rule correlates alerts from multiple integrations and event categories that involve different user.name values
 12which may represent the same real-world identity. It uses an LLM-based similarity analysis to evaluate whether multiple
 13user identifiers (e.g. naming variations, formats, aliases, or domain differences) likely belong to the same person.
 14"""
 15from = "now-60m"
 16interval = "30m"
 17language = "esql"
 18license = "Elastic License v2"
 19name = "Correlated Alerts on Similar User Identities"
 20note = """## Triage and analysis
 21
 22> **Disclaimer**:
 23> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, analysts should validate findings against their environment and identity architecture.
 24
 25### Investigating Correlated Alerts on Similar User Identities
 26
 27This rule identifies alerts from multiple integrations and event categories involving different `user.name` values that may represent the same real-world identity.
 28An LLM is used to assess string similarity and naming patterns to determine whether multiple user identifiers likely belong to the same person, which may indicate account compromise, credential abuse, or identity misuse across systems.
 29
 30### Possible investigation steps
 31
 32- Review the correlated `user.name` values and validate whether they represent naming variations, aliases, or identity mappings.
 33- Examine the LLM output fields (`verdict`, `confidence`, `summary`) as decision support, not ground truth.
 34- Analyze the diversity of alert sources, event categories, and detection rules involved.
 35- Reconstruct the alert timeline to identify potential stages such as initial access, lateral movement, privilege escalation, or persistence.
 36- Correlate with authentication logs, IAM/SSO telemetry, EDR data, and network logs to identify shared sessions, IPs, devices, or hosts.
 37- Validate identities against directory services, identity providers, and federation mappings.
 38
 39### False positive analysis
 40
 41- Identity format variations across systems (e.g., `first.last`, `flast`, `user@domain`).
 42- Federated identity mappings between on-prem, cloud, and SaaS platforms.
 43- Service, automation, and CI/CD accounts with similar naming conventions.
 44- Separate admin and standard user accounts for the same individual.
 45- Shared credentials or naming templates in development and test environments.
 46
 47### Response and remediation
 48
 49- Temporarily disable or suspend correlated accounts if compromise is suspected.
 50- Revoke active sessions, tokens, and credentials.
 51- Investigate access scope, privileges, and lateral movement paths.
 52- Perform endpoint and identity forensics to identify persistence mechanisms.
 53- Remediate IAM misconfigurations and federation issues.
 54- Enhance monitoring for identity correlation, credential misuse, and cross-platform abuse."""
 55references = [
 56    "https://www.elastic.co/docs/reference/query-languages/esql/esql-commands#esql-completion",
 57    "https://www.elastic.co/docs/explore-analyze/elastic-inference/eis-supported-models",
 58    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 59]
 60risk_score = 73
 61rule_id = "1bb329a5-2168-4da5-b7b9-d42a51deb6dd"
 62setup = """## Setup
 63
 64### LLM Configuration
 65
 66This rule uses the ES|QL COMPLETION command with Elastic Inference Service Claude Sonnet 4.6
 67(`.anthropic-claude-4.6-sonnet-completion`), which is available out-of-the-box in Elastic Cloud deployments
 68with an appropriate subscription. See [EIS supported models](https://www.elastic.co/docs/explore-analyze/elastic-inference/eis-supported-models).
 69
 70To use a different LLM provider (Azure OpenAI, Amazon Bedrock, OpenAI, or Google Vertex), configure a connector
 71following the [LLM connector documentation](https://www.elastic.co/docs/explore-analyze/ai-features/llm-guides/llm-connectors)
 72and update the `inference_id` parameter in the query to reference your configured connector.
 73"""
 74severity = "high"
 75tags = [
 76    "Domain: Identity",
 77    "Use Case: Threat Detection",
 78    "Use Case: Identity and Access Audit",
 79    "Resources: Investigation Guide",
 80    "Resources: LLM",
 81    "Rule Type: Higher-Order Rule",
 82    "Noise: Low",
 83    "Performance: Normal",
 84    "Rule Type: ES|QL",
 85]
 86timestamp_override = "event.ingested"
 87type = "esql"
 88
 89query = '''
 90from .alerts-security.*
 91
 92// truncate timestamp to 5-minute window
 93| eval Esql.time_window_date_trunc = date_trunc(5 minutes, @timestamp)
 94
 95// high severity alerts excluding system standard user.ids
 96| where kibana.alert.rule.name is not null and user.name is not null and kibana.alert.risk_score >= 73 and kibana.alert.workflow_status == "open" and 
 97        not kibana.alert.rule.type in ("threat_match", "machine_learning") and
 98        not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20", "0")
 99
100// group alerts by short time window and extract values of interest for alert triage
101| stats Esql.event_module_distinct_count = COUNT_DISTINCT(event.module),
102        Esql.user_name_distinct_count = COUNT_DISTINCT(user.name),
103        Esql.rule_name_distinct_count = COUNT_DISTINCT(kibana.alert.rule.name),
104        Esql.event_category_distinct_count = COUNT_DISTINCT(event.category),
105        Esql.rule_risk_score_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
106        Esql.event_module_values = VALUES(event.module),
107        Esql.rule_name_values = VALUES(kibana.alert.rule.name),
108        Esql.message_values = VALUES(message),
109        Esql.event_category_values = VALUES(event.category),
110        Esql.event_action_values = VALUES(event.action),
111        Esql.source_ip_values = VALUES(source.ip),
112        Esql.destination_ip_values = VALUES(destination.ip),
113        Esql.host_id_values = VALUES(host.id),
114        Esql.agent_id_values = VALUES(agent.id),
115        Esql.rule_severity_values = VALUES(kibana.alert.risk_score),
116        Esql.user_name_values = VALUES(user.name) by Esql.time_window_date_trunc
117
118// filter for alerts from different integrations with unique categories
119| where Esql.event_module_distinct_count >= 2 and Esql.user_name_distinct_count >= 2 and Esql.event_category_distinct_count >= 2
120
121// build context for LLM analysis
122| eval users_list = MV_CONCAT(Esql.user_name_values, ",")
123
124// LLM analysis
125| eval instructions = "Analyze the provided user names and return a boolean value true if at least 2 of them are similar and they may belong to the same human identity or false if not, do not compare user names that may look like service accounts. If the list of users has more than 2 users and only 2 of them are similar consider this as true. Structure the output as follows: verdict=<verdict> confidence=<score between 0.0 and 1.0> summary=<short reason max 500 words> without any other response statements on a single line."
126| eval prompt = CONCAT("User identities extracted from different alerts: ", users_list, instructions)
127| COMPLETION triage_result = prompt WITH { "inference_id": ".anthropic-claude-4.6-sonnet-completion"}
128
129// parse LLM response
130| DISSECT triage_result """verdict=%{Esql.verdict} confidence=%{Esql.confidence} summary=%{Esql.summary}"""
131
132// filter for similar user values
133| where TO_LOWER(Esql.verdict) == "true"
134| keep Esql.*
135'''