Greetings Team,
If we do not want to use Google Cloud's native silent log source monitoring, is there any alternative approach using a scheduled YARA-L rule, similar to the one below that runs hourly?
I understand that this approach has a few limitations:
-
The rule requires at least one event from the log source within the previous 24 hours If incase a log source has been completely silent from the beginning (i.e., no events have been ingested within the 24-hour lookback window), the rule will not detect it.
-
For intermittently logging sources, because the rule is scheduled to run every hour, it will continue to generate an alert every hour until the log source resumes sending logs consistently. i am aware that even configuring alert suppression to reduce repeated alerts for the same log source, However, will introduces another limitation: if the log source resumes logging and then becomes silent again during the suppression period, the subsequent log stoppage may not be detected because the alert is still being suppressed.
Given these limitations, is there a better or recommended YARA-L-based approach for monitoring silent log sources apart from google cloud monitoring alert? i am mainly interested in yara l based approach
sheduled hourly
events:
$event.metadata.log_type != ""
$log_type = $event.metadata.log_type
match:
$log_type over 24h
outcome:
$max_event_time = max($event.metadata.event_timestamp.seconds)
$seconds_since_last_event = timestamp.current_seconds() - $max_event_time
condition:
$event and $seconds_since_last_event > 1800
}
