🚨 Kibana ES|QL Alerting Rules¶

This document contains ES|QL queries that match the actual data field structure for Kibana's Stack Management > Rules interface. (Rules Page)

✅ WORKING RULES - Copy & Paste Ready¶

🔥 1. BRUTE FORCE ATTACK DETECTION ✅¶

Rule Name: Brute Force Login Attempts¶

ES|QL Query:¶

FROM security-auth-logs-*
| WHERE event.action == "authentication_failure" AND event.outcome == "failure"
| STATS failed_attempts = COUNT(*) BY source.ip, user.email
| WHERE failed_attempts >= 3
| EVAL threat_level = "HIGH", attack_type = "Brute Force"

Time Window: 5 minutes¶

Description: Detects 3+ failed login attempts from same IP or user (lowered threshold for testing)¶

🔥 2. HIGH VOLUME AUTHENTICATION ATTEMPTS ✅¶

Rule Name: High Volume Authentication Activity¶

ES|QL Query:¶

FROM security-auth-logs-*
| STATS auth_count = COUNT(*) BY source.ip, user.email
| WHERE auth_count >= 10
| EVAL threat_level = "MEDIUM", attack_type = "High Volume Auth"

Time Window: 5 minutes¶

Description: Detects 10+ authentication attempts from same IP/user combination¶

🔥 3. POWERSHELL ATTACK DETECTION ✅¶

Rule Name: PowerShell Encoded Commands¶

ES|QL Query:¶

FROM security-powershell-logs-*
| WHERE event.action == "powershell_execute"
| WHERE process.command_line RLIKE ".*(-enc|-EncodedCommand|base64).*"
| STATS attack_count = COUNT(*) BY source.ip, user.name
| WHERE attack_count >= 1
| EVAL threat_level = "CRITICAL", attack_type = "PowerShell LOLBINS"

Time Window: 2 minutes¶

Description: Detects any encoded PowerShell execution¶

🔥 4. PRIVILEGE ESCALATION DETECTION ✅¶

Rule Name: Privilege Escalation Attempts¶

ES|QL Query:¶

FROM security-privilege-logs-*
| WHERE event.action == "privilege_use" AND event.outcome == "failure"
| STATS escalation_attempts = COUNT(*) BY user.name, host.name
| WHERE escalation_attempts >= 2
| EVAL threat_level = "HIGH", attack_type = "Privilege Escalation"

Time Window: 5 minutes¶

Description: Detects 2+ failed privilege escalation attempts¶

🔥 5. LATERAL MOVEMENT DETECTION ✅¶

Rule Name: Network Lateral Movement¶

ES|QL Query:¶

FROM security-lateral-logs-*
| WHERE event.action == "authentication_success"
| STATS unique_hosts = COUNT_DISTINCT(host.name) BY source.ip, user.name
| WHERE unique_hosts >= 2
| EVAL threat_level = "HIGH", attack_type = "Lateral Movement"

Time Window: 15 minutes¶

Description: Detects successful authentication to 2+ different hosts from same source¶

🔥 6. NETWORK ANOMALY DETECTION ✅¶

Rule Name: Suspicious Network Activity¶

ES|QL Query:¶

FROM security-network-logs-*
| WHERE network.bytes_out > 1048576
| STATS total_bytes = SUM(network.bytes_out) BY source.ip, destination.ip
| EVAL total_data_mb = total_bytes / 1048576
| WHERE total_data_mb > 5
| EVAL threat_level = "MEDIUM", attack_type = "Large Data Transfer"

Time Window: 10 minutes¶

Description: Detects large data transfers (>5MB total)¶

🔥 7. HIGH FREQUENCY AUTHENTICATION ✅¶

Rule Name: Rapid Authentication Attempts¶

ES|QL Query:¶

FROM security-auth-logs-*
| WHERE event.action RLIKE ".*(authentication|login).*"
| STATS auth_count = COUNT(*) BY source.ip
| WHERE auth_count >= 20
| EVAL threat_level = "MEDIUM", attack_type = "High Frequency Auth"

Time Window: 5 minutes¶

Description: Detects 20+ authentication attempts from single IP¶

🔥 8. SECURITY ALERTS CORRELATION ✅¶

Rule Name: Multiple Security Event Types¶

ES|QL Query:¶

FROM security-alerts-*
| STATS
    alert_types = COUNT_DISTINCT(threat_details.threat_type),
    total_alerts = COUNT(*)
    BY threat_details.src_ip
| WHERE alert_types >= 2 OR total_alerts >= 3
| EVAL threat_level = "HIGH", attack_type = "Multi-Vector Attack"

Time Window: 30 minutes¶

Description: Detects multiple alert types or high volume from same source¶

🔥 9. SUSPICIOUS IP BEHAVIOR ✅¶

Rule Name: Abnormal Source IP Activity¶

ES|QL Query:¶

FROM security-auth-logs-*
| STATS
    unique_users = COUNT_DISTINCT(user.email),
    unique_actions = COUNT_DISTINCT(event.action),
    total_events = COUNT(*)
    BY source.ip
| WHERE (unique_users >= 3) OR (unique_actions >= 5) OR (total_events >= 20)
| EVAL threat_level = "MEDIUM", attack_type = "Suspicious IP Behavior"

Time Window: 15 minutes¶

Description: Detects IPs with suspicious patterns (many users, actions, or events)¶

🔥 10. COMBINED THREAT DETECTION ✅¶

Rule Name: Multi-Stage Attack Detection¶

ES|QL Query:¶

FROM security-auth-logs-*, security-powershell-logs-*, security-privilege-logs-*
| WHERE event.action IN (
    "authentication_failure",
    "authentication_success",
    "process_start",
    "privilege_use"
)
| STATS
    attack_stages = COUNT_DISTINCT(event.action),
    total_events = COUNT(*)
    BY source.ip
| WHERE attack_stages >= 3
| EVAL threat_level = "CRITICAL", attack_type = "Multi-Stage APT"

Time Window: 30 minutes¶

Description: Detects 3+ different attack stages from same source IP¶

Email Action Setup Steps:¶

1. In the Actions section (what I see in our screenshot):

2. Click "Add action"

3. Select our Gmail connector from the dropdown

4. Configure the Email Action:

To:¶

• Enter our email address

Subject:¶

🚨 SECURITY ALERT - {{rule.name}} - {{context.threat_level}}

Body:¶

🚨 SECURITY ALERT TRIGGERED

- Rule Name: {{rule.name}}
- Threat Level: {{context.threat_level}}
- Attack Type: {{context.attack_type}}
- Detection Time: {{context.date}}
- Events Detected: {{context.hits}} events

🔍 Investigation Required:

- Check source IP reputation
- Review user account activity
- Analyze attack timeline
- Implement containment if needed

1. Save the Rule

2. After adding the email action, click "Save" to create the rule.

3. Repeat for All 10 Rules

🧪 Testing Instructions¶

1. Generate Test Attacks:

   ./scripts/apt-simulations-test/full-attack.sh
   

2. Test Individual Query in Kibana Discover:

   FROM security-auth-logs-* | WHERE event.action == "authentication_failure" | LIMIT 10
   

3. Create Rule:

4. Go to Stack Management > Rules
5. Create rule > Elasticsearch query
6. Select ES|QL tab
7. Copy-paste any query above
8. Set time field to @timestamp

⚠️ Important Notes¶

• Lower Thresholds: Thresholds are set low for testing/demo purposes
• Field Names: These queries use the actual field names in our data
• Index Patterns: Match our existing security indices
• Time Windows: Adjusted for demo - increase for production

✅ Validated Queries¶

All queries in this file: - ✅ Use correct field names from our data - ✅ Reference existing indices - ✅ Have been tested for syntax errors - ✅ Include proper ES|QL syntax - ✅ Ready for copy-paste into Kibana