+11I noticed that some of the new curated rules land with detecting (status) disabled and alerting enabled.
I was wondering if this is a misconfiguration or if alerting will continue to work even though detecting (whose field name in the API calls is actually status) is disabled.
Best answer by cmorris
New rules in a pack should respect the pack’s setting. If you are not seeing that, it may be a bug with the release of this rule. Leaving a rule set to alerting with detections set to disabled does have a use case for retrohunts (rule can be run manually over set range and will still create alerts without running against live data), but that would be applicable to custom rather than curated detections.
+17You would want to enable ‘Detecting’. The rule shows a status of Disabled at the top. After enabling the detecting piece, it will show Enabled
+11Thanks
+17New rules in a pack should respect the pack’s setting. If you are not seeing that, it may be a bug with the release of this rule. Leaving a rule set to alerting with detections set to disabled does have a use case for retrohunts (rule can be run manually over set range and will still create alerts without running against live data), but that would be applicable to custom rather than curated detections.
+11Okay, thanks for your answers,
+11
This curated rule was updated today by Google. The curated rule set (Cloud Composite Rules > AWS - Identity) and the rule precision changed from PRECISE to BROAD. The deployment state was updated from "detecting = enabled AND alerting = enabled" to "detecting = disabled AND alerting = enabled" when the curated rule set it is part of (as well as the one it was in before) has a different configuration. Something isn't right.
+17
Could you open a case for further investigation?
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
