Hi #community,
Is there any option to throttle or prevent a rule with same criteria triggers for x period of time since it was last triggered. Let's say we keep receiving bruteforce for multiple user out of which one of them was targeted recently. My rule currently detects more than 3 authentication failure for one user within 10 min. The issue is every 10 min the rule will check for the activity and detects events matching criteria including the one that was already triggered.
I do not want to increase the frequency as I want the detection to be almost real time, and want to exclude the same criteria (same source and same user) for the next 1 hours since it was once triggered. This is to prevent analyst from being buried down in anlerts Below is the sample of the rules in-context.
rule google_login_bruteforce {
meta:
author = "Srijan Kafle"
description = "Detects more than 3 authentication failure in google accounts"
severity = "Medium"
created = "2023-12-13"
product = "google"
service = "login"
mitre = "Brute Force, t1110"
events:
$failure.metadata.log_type = "WORKSPACE_ACTIVITY" and $failure.metadata.product_event_type = "login_failure"
$failure.security_result.about.email = $user
match:
$user over 10m
outcome:
$risk_score = 3
condition:
#failure >= 3
}
