Multiple namespaces involved in single alert: environment routing ?

Question

Hello guys,I have a theoretical question for my understanding of SecOps behavior when namespaces are involved. Let’s say I have a SecOps instance with multiple namespaces configured, and matching environments configured on the SOAR part (1 to 1 with namespaces). I also have a multi-event rule that monitors  events regardless of namespace. The rule also has a `match` field that is not an asset. My question:If this multi-event rule triggers based on data from multiple namespaces, in what environment will the alert land ?

MitchellR · Accepted Answer

Hey Chris,By default, the SOAR connector defaults to grab the first event’s namespace if multiple are grouped in the detection - however, anecdotally, this doesn’t necessarily mean the first in terms of timestamp.Is cross-namespace correlation intentional for the use case? If it is, you could add an outcome variable to the rule that carries the routing value explicitly to control it to a “primary” or “central” environment, or derives it from the namespaces involved in the events. Granted, that would require either a second connector to handle this specific rule ID assuming you didn’t want to make that a wholesale change for all detections.If cross-namespace joins aren’t wanted, then as you’re probably aware, you can just add a namespace equality condition in the rule across the event variables or in the match.Separately, data RBAC could make this messy if tied to namespaces since the analyst(s) may not be able to access the expected environment in SOAR and/or in SIEM depending on where it routes.

chrisd2 · Answer

Hello Mitchell,Thanks a lot for the detailed feedback !Yes I was considering intentional cross-namespace correlation.I find the dedicated outcome field solution + connector relevant. The sad part is, that it would be -1 outcome field for real alert data :(Thanks again.Regards,

Sign up

Login with SSO

Login to the community

Login with SSO