Detection gaps

Question

Hey guys, do any of you know of a way to efficiently identify which log sources you need ingested in order for the curated detections or even custom rules to work as intended? Google secops currently doesn’t tell you which logs are needed and/or missing for a rule to be accurate.

AymanC · Accepted Answer

Hi ​@rlewis,Typically the ‘overview’ documentations within detection lists the compatible log sources for Curated Detections. If you’re an Enterprise+ customer, from memory you can also see the rule logic behind these rules to see see more specifics.https://docs.cloud.google.com/chronicle/docs/detection/cloud-threats-categoryhttps://docs.cloud.google.com/chronicle/docs/detection/composite-rules-categoryhttps://docs.cloud.google.com/chronicle/docs/detection/chrome-enterprise-threats-categoryhttps://docs.cloud.google.com/chronicle/docs/detection/linux-threats-categoryhttps://docs.cloud.google.com/chronicle/docs/detection/macos-threats-categoryhttps://docs.cloud.google.com/chronicle/docs/detection/mandiant-hunt-categoryhttps://docs.cloud.google.com/chronicle/docs/detection/risk-analytics-ueba-categoryhttps://docs.cloud.google.com/chronicle/docs/detection/windows-threats-categoryhttps://docs.cloud.google.com/chronicle/docs/detection/ati-curated-detectionsKind Regards,Ayman

rlewis · Answer

thanks ​@AymanC I’ll take a look through these docs. I tried to open up a specific curated detection to check to the metadata for that information but I didn’t see any info like that but I could have missed it somewhere.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded