Hi All,
I am having issues with MISP rules in SecOps. We have integrated via the documentation here using a Webhook: https://cloud.google.com/chronicle/docs/ingestion/default-parsers/misp
The parser itself whilst it does extract some fields is still raw and doesn't correlate timeframes. We aren't interested in the time the IoC was ingested from MISP but rather the time ti was published from the third party threat provider in a field known as
extracted.fields["Event.date"])
strings.concat($g.extracted.fields["Event.date"], " 00:00:00")
The issue is that it is supposed to look for all fields of this value within the past 6 months and then correlate these to new events of other log sources with field 'IP'. The date of ingestion for MISP events really isn't important here. You can see the code snippet for this below:
events:
$ip = $e.principal.ip
$userid = $e.target.user.userid
// MISP IOC data (joined via IP)
$e.principal.ip = $g.extracted.fields["Event._AttributeFlattened[0].value"]
$g.metadata.log_type = "MISP_IOC"
$g.extracted.fields["Event.Attribute[0].category"] = "Network activity"
$ioc_event_date = ($g.extracted.fields["Event.date"])
$ioc_event_timestamp = strings.concat($g.extracted.fields["Event.date"], " 00:00:00")
match:
$userid over 1m
outcome:
// Parse timestamp
$event_time = max($e.metadata.event_timestamp.seconds)
// Parse MISP date
$misp_time = max(timestamp.as_unix_seconds($ioc_event_timestamp, "GMT"))
// Calculate delta in days
$ioc_delta = ($event_time - $misp_time) / 86400
// Risk scoring
$risk_score = max(35)
+ if($ioc_delta <= 1, 45, 0)
+ if($ioc_delta <= 7 and $ioc_delta > 1, 30, 0)
+ if($ioc_delta <= 30.44 and $ioc_delta > 7, 10, 0)
+ if($ioc_delta <= 60 and $ioc_delta > 30.44, 0, 0)
- if($ioc_delta > 60, 10, 0)
condition:
$e and $g and $ioc_delta < 180
}If someone has had any experience with authoring rules from webhook methodology that could help resolve this issue that would be greatly appreciated. I am not interested in importing CSVs as this is a very static approach and we want to keep things as automated as possible.
Thank you in advance.
