Conversation
rvald26
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Windows authentication events can legitimately omit an IP or use a placeholder. This draft validates the original vendor IP before promotion and updates seven correlation rules to use a scoped IP, workstation or domain-qualified account identity. Historical searches count the same suspicious candidates as the trigger, preventing benign same-code events from filling the threshold.
It also fixes numeric-zero NTLM status being misclassified as failure and promotes verified native computer, timestamp, Workstation, remote port, process path and domain fields into the SDK standard. Existing vendor aliases needed by rules are retained. ThreatWinds go-sdk v1.1.31 is the schema/runtime authority.
The IP guard also excludes expanded/compressed IPv6 zero and IPv4-mapped zero using CIDR checks, preserving the original vendor value. These spellings are covered by synthetic fallback and nonzero controls, not new live incidence claims.
Validation: 60 synthetic raw JSON cases, 50 positive predicate/history cases, all 38 Windows predicates, strict SDK decoding/CEL, and actual SDK history requests against a local OpenSearch mock. Checks cover thresholds, expired history, identity/domain/collector separation, benign-history exclusion and the missing-placeholder-before-OR regression. The shared normalization/contract runner also passes.
A bounded read-only sample of 28 distinct records across three instances confirmed missing standard promotions and IP-less local/NTLM events. The relevant deployed filter configuration was compared. Recent sampled Kerberos populations did not show placeholder IPs; that scenario is a synthetic regression, not a claimed live observation. Customer data is not included.
The raw parser/normalizer is an offline model; closed EventProcessor execution, actual alert creation and before/after alert volume remain staging checks. Filter and rules must roll out together; the new history fields need their normal windows to warm up. Indexed lastEvent grouping depends on #2590, which has a separate rollout review.
Draft only, targeting official utmstack/UTMStack v11. No customer configuration changed; nothing merged or deployed. Details: filters/audits/windows.md.