Hello everyone,
has anyone tried using detection_window in the options?
I found it in the documentation, but I don't know how to use it, and it was only mentioned in an example rule; it doesn't appear in the options section.
When I put it in one of my rules, it doesn't work.
rule failed_logins_from_new_location
{
meta:
author = "Security Team"
description = "Detects multiple failed logins for a user from a new, never-before-seen IP address within 10 minutes."
severity = "HIGH"
events:
$e.metadata.event_type = "USER_LOGIN"
$e.security_result.action = "FAIL"
$user = $e.target.user.userid
$ip = $e.principal.ip
outcome:
$failed_login_count = count($e)
$unique_ips = count_distinct($ip)
$first_fail_time = min($e.metadata.event_timestamp)
match:
$user over 10m
condition:
#e >= 5
options:
detection_window=2d
}taken from doc “ The options section specifies when the query first runs: it looks back two days.”
Reference link:
https://docs.cloud.google.com/chronicle/docs/yara-l/yara-l-overview
