Anomaly Detection

1. Vendor Dashboards

2. Anomaly Overview: Provides an operational view of anomaly activity across the environment

3. Entity Overview: Investigation-focused dashboard built around affected entities, including, users, hosts, and source addresses.

1. Anomalous Entity Analytics: Pre-built searches that pull together every anomaly for one entity, its score, and the rule that raised it.

1. Anomalous access followed by anomalous execution: Fires when an account logs in unusually and then runs unusual commands or tools within 4 hours.
2. Credential attack followed by anomalous access: Fires when a spike in failed logins or lockouts is followed within 6 hours by an unusual login on the same account.
3. Authentication anomalies across many identities: Fires when failed logins or lockouts hit 15 or more accounts within 1 hour, a sign of password spraying.
4. Off-hours login followed by anomalous data access: Fires when an account logs in at an unusual time and then accesses data unusually within 8 hours.
5. VPN session anomalies with anomalous access: Fires when one account has both a VPN session anomaly and an access anomaly within 12 hours.
6. Service account with interactive behaviour: Fires when a listed service account behaves like a person, such as logging in from a new device or at an unusual time.
7. Multiple elevation anomalies for one identity: Fires when one account triggers two or more privilege escalation anomaly rules within 4 hours.

1. Anomalous execution and persistence on one host: Fires when one host triggers four or more endpoint anomaly rules within 8 hours.
2. Anomalous execution followed by scheduled task: Fires when unusual execution is followed within 2 hours by an unusual scheduled task on the same account.
3. Audit log tampering following anomalous execution: Fires when unusual execution is followed within 4 hours by cleared logs or audit policy changes on the same host.
4. Rare process outbreak across multiple hosts: Fires when the same rare process appears on five or more hosts within 8 hours.

Network and data exfiltration rules

1. Anomalous execution followed by outbound channel: Fires when unusual execution on a host is followed within 6 hours by unusual outbound traffic from that host.

2. Anomalous channel to threat intel destination: Fires when unusual outbound traffic goes to a destination with a threat intelligence score above 70.

3. Converging network anomalies from one host: Fires when one internal host triggers four or more kinds of network anomaly within 6 hours.

4. Anomalous cloud collection followed by upload: Fires when one account shows unusual data collection and cloud uploads within 12 hours.

5. Upload tooling followed by large outbound transfer: Fires when an account runs upload or compression tools and then makes a large outbound transfer within 4 hours.

Account and host spread rules

1. Identity anomalous across multiple hosts: Fires when one account triggers three or more anomaly rules across three or more hosts within 4 hours.

2. Multiple identities anomalous on one host: Fires when five or more accounts have anomalies on the same host within 6 hours.

3. Shared access infrastructure across many identities: Fires when ten or more accounts show access anomalies from the same external source address within 6 hours.

4. Simultaneous anomalies across one peer group: Fires when three or more members of the same peer group have anomalies within 6 hours.

Anomaly volume, score, and corroboration rules

1. Identity anomalous across two or more detectors: Fires when one account triggers six or more anomaly rules from three or more detectors within 1 day.

2. Sustained anomaly accumulation on one entity: Fires when one entity’s anomaly scores total 400 or more within 1 day.

3. Ten anomalies for one entity within five minutes: Fires when one entity produces ten or more anomalies within five minutes, a sign of scripted or automated activity.

4. Persistently recurring anomaly on one subject: Fires when an entity’s anomalies recur ten or more times over a month, from three or more anomaly rules.

5. Extreme deviation score outlier: Fires when an anomaly with a deviation score of 90 or higher occurs twice for the same entity within 12 hours.

6. High score anomalies on a critical entity: Fires when a critical or high-criticality entity has three or more anomaly rules scoring 70 or higher within 1 day.

7. Anomaly corroborated by signature alert: Fires when one account has an anomaly scoring 50 or higher and a signature-based incident within 12 hours.

For more information on the shipped components and how to use it, see Vendor dashboards, search templates, and alert rules.