Integration of Third Party Native Alerts

Stellar Cyber's built-in alerts are created from data pathways that leverage raw data collected from all forms of data sources, including third party services and Stellar Cyber’s sensors. You can choose to allow Stellar Cyber's Machine Learning (ML) and Statistical Analysis (SA) to generate alerts based on raw data ingested from third party services. For certain services, you can additionally choose to ingest and integrate alerts that are natively created in those services.

This topic summarizes which third party services and products Stellar Cyber supports for native alert integration and how those alerts are mapped in Stellar Cyber.

Third Party Native Alert Mapping

Stellar Cyber handles each service and product in a custom manner, according to the nature of the incoming data, including third party native alerts and other security events. To view alerts and events from multiple sources in our unified, common platform, Stellar Cyber normalizes and enriches the third party native alerts and security events during the data ingestion process. With ingested, normalized, and enriched third party native alerts and security events, Stellar Cyber further applies ML/SA engines, a direct mapping, or a combination of the two, to create Stellar Cyber alerts mapped to the XDR Kill Chain with additional deduplication to reduce noise and alert fatigue.

Review the following to better understand the native third party alert mapping Stellar Cyber is doing to help you get to the decision points more efficiently:

  • Deduplication:  In mapping third-party native alerts and security events to the XDR Kill Chain, Stellar Cyber uses a variety of methods to identify and eliminate potential duplicates for each applicable alert or event type. In particular, Stellar Cyber identifies a combination of fields and values to be key characteristics and uses those to identify duplicates. An example method is to compare the values in that combination for each new third party native alert; if the same value set occurs within a time threshold, that record is considered a duplicate and only the original record is mapped. This process is a critical mechanism to eliminate noise and reduce alert fatigue.

  • Normalization: A key benefit of Stellar Cyber is standardization of all incoming data sources to a common data model (Interflow record), that includes some fields based on the Elastic Common Schema (ECS). Values from the incoming raw data are mapped into standardized fields in Stellar Cyber. In some cases, the original data field is still saved with the Interflow record.  This normalization allows Stellar Cyber Analytics and Machine Learning to perform complex analysis and identify related events from disparate ingestion sources. Here are examples of normalization:

    • crowdstrike.event.LocalIP is mapped to Stellar Cyber's host.ip field

    • threatInfo.classification is mapped to Stellar Cyber threat field

  • Enrichment: Stellar Cyber's data framework requires certain fields to help identify the data source, the category of data, the type of event, to support scoring calculations and certain other activities. In some cases, the ingested data can be directly mapped into these fields. In other cases, Stellar Cyber generates that data.  Examples of data enrichment are:

    • (No incoming source field) msg_origin.source is created and populated with the vendor name, such as crowdstrike

    • (No incoming source field) msg_origin.category is created and populated with the applicable category for the data type, such as endpoint

    • Incoming data source field crowdstrike.metadata.eventType field exists and its value (such as crowdstrike_detection_summary) is mapped to Stellar Cyber field msg_class

    • Incoming data source field event.technique.name field exists and its value is either mapped directly or algorithmically standardized to populate to Stellar Cyber field xdr.event_name.

    • Populating the xdr_event structure is a key part of enrichment, with Stellar Cyber ensuring that a Tactic, Technique, and Procedure name, and important scores, are present in every Alert record.

Supported Native Third Party Alerts

The table below lists all the services and products for which Stellar Cyber has developed direct integration of third party native alerts, which includes mapping to the Stellar Cyber XDR Kill Chain and adding those alerts to the Alert index. Data not directly mapped is still run through the Stellar Cyber ML/SA pipeline, where applicable. The third party native alerts that are not mapped are ingested and available for creating ATH rules for automatic actions and entry of the result into the Alert index.

Use the table below to identify the data applicable for direct alert mapping, the method of ingestion, and the nature of the mapping.

  • In cases where a value is indicated as Derived, Stellar Cyber assigns a value based on other attributes in the ingested data.

  • Where possible, links to the third party data type format are provided for reference.

For the Key Fields for Third Party Alerts, see Key Fields for Third Party Native Alert Types.

Third Party Service

Third Party Data Type

Ingestion
Method

Mapping of Native Alerts to Stellar Cyber Alerts

Notable Interflow Fields

Acronis Cyber Protect Cloud

Acronis Cyber Protect Cloud Alerts

Acronis Cyber Protect Cloud Connector

This connector ingests logs from Acronis Cyber Protect Cloud to get the raw alerts that are stored in the Syslog index.

Select the Alerts content type.

Stellar Cyber maps Acronis Cyber Protect Cloud alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

The following four alert types are supported: Email security, EDR, Antimalware protection, and URL filtering.

Tactic and Technique are based on alert type.

Deduplication is by tenantid, event.threat.name, host.name, user.name, url, process.pid, file.hash.sha1, email.from.address, and acronis_cyber_protect.details.edrAlertId.

Alerts from Acronis Email security are not correlated into cases in Case Management.

Avanan

Avanan Alerts

The alert types are:

  • spam

  • phishing

  • suspicious_phishing

  • malware

  • shadow_it

  • dlp

  • alert

  • anomaly

  • malicious_url

Configure ingestion of HTTP JSON format logs to a Stellar Cyber sensor.

Avanan sends email data to the Stellar Cyber Syslog index, which maps Avanan alerts to the Alerts index.

Deduplication is by tenantid, email.sender.address, and email.from.address.

If neither email.sender.address or email.from.address exists, file.name is used for deduplication.

To search the alerts in the Alerts index or to search the Original Records in the Syslog index, use the queries:

  • msg_class: avanan AND event.action: Delivered

  • msg_class: avanan AND event.action: Quarantined

AWS GuardDuty

AWS GuardDuty Alerts

Refer to Amazon GuardDuty.

AWS GuardDuty Connector

This connector ingests logs from AWS GuardDuty to get the raw alerts that are stored in the Syslog index.

Stellar Cyber maps AWS GuardDuty alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid and aws_guardduty_id.

Bitdefender

URL--based

Antiphishing

Data Protection

User Control / Content Control

IP-based

Firewall

Ransomware activity detection

Threat-based

Advanced Threat Control (ATC)

Antiexploit Event

Antimalware

Hyper Detect event

Sandbox Analyzer Detection

Storage Antimalware

Configure ingestion of Bitdefender's Push event for JSON RPC messages to send data to a Stellar Cyber sensor configured to ingest httpjson (port 5200) over TLS.

Of the different record types you can configure to push to Stellar Cyber's httpjson parser, the 11 at left are normalized and enriched as they are added to the Syslog index. The records are evaluated against existing records in the Alert index-- those that do not already exist are directly mapped to the Alert index and XDR Kill chain.  The other records are run through the ML/SA pipeline, which may generate alerts based on those algorithms. The labels assigned to the alert groups at left refer simply to the nature of the key data points for those alerts. Specifically, these data are supplied with the relevant alert description (Bitdefender field in parenthesis):

  • URL-based alerts: event.type (module acronym), host.name (computer_fqdn), host.ip (computer_ip), url

  • IP-based alerts: event.type (module acronym), host.name (computer_fqdn), host.ip (computer_ip), srcip (attack source or source-ip)

  • Threat-based alerts: event.type (module acronym), host.name (computer_fqdn), host.ip (computer_ip), threatName, where threatName varies depending on the record type (malware_name, threatType, detection_threatName, attack_types, aph_type, exploit_type, or target_type)

See the Bitdefender connector information card for more details on normalization of these and other Bitdefender records.

Deduplication is by the following fields:

  • IP—tenantid, event.type, host.name, host.ip, and srcip.

  • Threat—tenantid, event.type, host.name, host.ip, and event.threat.name.

  • URL—tenantid, event.type, host.name, host.ip, and url.

Blackberry CylancePROTECT and CylanceOPTICS

CylancePROTECT:

Exploit Attempts

Script Control

Threats

CylanceOPTICS:

Detections

Forward log files to port 5177 (specific for handling Cylance logs)

The Blackberry Cylance Connector is applicable only for response actions.

  • For CylancePROTECT, three types of Cylance events are mapped to the XDR Kill Chain and Stellar Cyber's Alert index: Exploit Attempts, Script Control, and Threats. The other data (Audit Log, Device, Device Control, and Threat Classification) are ingested and mapped to the Syslog index (not Alerts index), and are not run through the ML/SA pipeline.

  • For CylanceOPTICS, Detection events are evaluated with Stellar Cyber time series analysis models to determine abnormality of the event before mapping.

Deduplication is by org_id, tenantid, event.type, host.name, host.ip, file_name, file_path, and process_name.

CylancePROTECT

CylanceOPTICS

CrowdStrike

Detections

CrowdStrike Streaming Connector can be configured to collect Host and Event logs (including Detection Summary Event).

Select the Detection Summary Event content type.

For Detection Summary Event, CrowdStrike's DetectionSummaryEvent and PatternDisposition records are used to derive certain fields for populating the alert into the Stellar Cyber alert index. The Tactic and Technique fields in the record are more directly mapped to Stellar Cyber's XDR Kill Chain.

Cybereason

MalOp

Cybereason Connector

Select the MalOp content type.

Stellar Cyber can generate alerts based on the Cybereason sensor and MalOp data, however the MalOp records are most applicable for direct mapping. The value in malopDetectionType is reformatted and used for the alert name. Stellar Cyber has evaluated each possible alert and assigned a corresponding MITRE | ATT&CK Stage, Tactic and Technique.

Deduplication is by tenantid, user_list, threat, host_list, file.name, and process.name.

Cynet

ADT Alerts

NextGen Antivirus Alerts

Threat Intelligence Alerts

Memory Protection Alerts

Network Activity Alerts

AMSI Alerts

Feature Alerts

Configure ingestion of CEF format logs to a Stellar Cyber sensor.

The collection of Cynet alerts listed here are read from the Syslog index, enriched and mapped (with deduplication) to the Alert index and Stellar Cyber Kill Chain. The Cynet alert type is mapped to Stellar Cyber's event.threat.name, which is shown in the key fields.

Deduplication is by tenantid, host.ip, event.threat.name, and file.name.

To search the alerts in the Alerts index or to search the Original Records in the Syslog index, use the query:

  • msg_class: cynet_alert AND _exists_: event.threat.name AND NOT event.threat.name: Audit

Deep Instinct

Events

Deep Instinct Connector

The connector can be used for three data types but only Events are applicable for alert mapping.

Select the Events content type.

The Events record includes a MITRE | ATT&CK structure with values that support direct mapping to Stellar Cyber's XDR Kill Chain. If the incoming tactic or technique are blank, the following values are assigned in Stellar Cyber:
tactic_name = XDR Malware
technique_name = XDR Miscellaneous Malware

Deduplication is by tenantid, event.type, host.name, host.ip, file.path, file.file_hash, and deep_instinct.action.

ESET Protect

ESET Protect Alerts and Events

The following types of alerts and events are supported: 

  • Filtered Websites Event

  • Firewall Aggregated Event

  • ESET Inspect Alert

  • Threat Event

Refer to Events exported to JSON format.

Configure ingestion of JSON format logs to a Stellar Cyber sensor.

Stellar Cyber maps ESET Protect alerts and events. The alerts and events are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by the following fields:

  • ESET Protect (Filtered Websites Event)—tenantid, eset.rule_id, host.name, file.hash.sha1, srcip, and dstip.

  • ESET Protect (Firewall Aggregated Event)—tenantid, event.threat.name, eset.source_uuid, srcip, dstip, and user.name.

  • ESET Protect (ESET Inspect Alert)—tenantid, eset.eialarmid, and eset.rulename.

  • ESET Protect (Threat Event)—tenantid, process.executable, host.ip, and file.hash.sha1.

To search the alerts in the Alerts index or to search the Original Records in the Syslog index, use the queries:

  • ESET Protect (Filtered Websites Event)—msg_origin.source: eset_protect AND eset.event_type: \"FilteredWebsites_Event\"

  • ESET Protect (Firewall Aggregated Event)—msg_origin.source: eset_protect AND eset.event_type: \"FirewallAggregated_Event\"

  • ESET Protect (ESET Inspect Alert)—msg_origin.source: eset_protect AND eset.event_type: \"ESET Inspect Alert\"

  • ESET Protect (Threat Event)—msg_origin.source: eset_protect AND eset.event_type: Threat_Event

Google Workspace Alert

Alerts

 

Google Workspace Connector

This connector can ingest Alerts from Google's Alert center and Application (audit) reports. The Gmail Phishing, Google Identity, and User Changes events from the Alert reports (and are specifically relevant to this mapping).

Select the Alert content type.

The Gmail Phishing, Google Identity, and User Changes alerts are mapped. All other data from Alerts and Applications (audit reports) are processed through Stellar Cyber's ML/SA workflow.

Deduplication is by org_id, tenantid, metadata.customerId, source, type, and metadata.alertId.

Huntress

Huntress Incidents

Huntress Connector

This connector ingests logs from Huntress to get the raw alerts that are stored in the Syslog index.

Select the Incident Reports content type.

Stellar Cyber maps Huntress incidents. The incidents are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid, huntress_id, huntress.organization_id, and huntress.account_id.

Huntress has six indicator types for Tactic and Technique mapping: monitored_files, process_detections, ransomware_canaries, footholds, managed_identity, and antivirus_detections. One incident could have as many as six indicators showing at the same time.

HYAS Protect

HYAS Protect passthrough alerts

The following are supported:

  • Domain tagged with Suspicious Registrar

  • Domain tagged as blocked by HYAS Engine

  • Domain tagged as Highly Suspicious

HYAS Protect Connector

This connector ingests logs from HYAS Protect to get the raw alerts that are stored in the Syslog index.

Select the DNS Log Reports content type.

Stellar Cyber maps HYAS Protect passthrough alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid, dns.question.name. and srcip.

LimaCharlie

LimaCharlie Alerts

The following types of events for alerts collected by LimaCharlie's EDR sensors are supported: 

  • Process Events

  • Logon Events

  • FIM Events

Refer to Events.

LimaCharlie Connector

This connector ingests logs from LimaCharlie to get the raw alerts that are stored in the Syslog index.

Select the Alerts content type.

Stellar Cyber maps LimaCharlie alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid and limacharlie.routing.event_id.

Tactic and Technique are provided by the LimaCharlie raw alerts field limacharlie.detect_mtd.tags.

Microsoft Defender for Endpoint

Syslog

Microsoft Defender for Endpoint Connectors

This connector ingests logs from Microsoft Defender for Endpoint (connector).

Select the Alerts content type.

There may be two data sources for third party native alerts if you have integrated both Microsoft Defender for Endpoint (connector) and Windows Defender Antivirus (free version).

The integration of Microsoft Defender for Endpoint (connector) may stop the alert mapping for Windows Defender Antivirus (free version).

Stellar Cyber maps Microsoft Defender ATP alerts.

Deduplication is by tenantid, host.ip, host.name, and microsoft_defender.id.

The lastUpdateTime timestamp is used with the API to pull alerts/events. The alertCreationTime timestamp is not used. This may result in the old event being pulled again when an update happens on the event.

Microsoft Defender for Cloud

Microsoft Defender for Cloud alerts

Refer to Alerts.

Azure Event Hub Connector

This connector ingests logs from the content type, Microsoft Defender for Cloud, to get the raw alerts that are stored in the Syslog index.

Stellar Cyber maps Microsoft Defender for Cloud alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid and microsoft_defender_cloud.SystemAlertId.

Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps alerts

The risk categories are:

0: THREAT_DETECTION

1: PRIVILEGED_ACCOUNT_MONITORING

2: COMPLIANCE

3: DLP

4: DISCOVERY

5: SHARING_CONTROL

7: ACCESS_CONTROL

8: CONFIGURATION_MONITORING

Microsoft Defender for Cloud Apps Connector

This connector ingests logs from Microsoft Defender for Cloud Apps to get the raw alerts that are stored in the Syslog index.

Select the Alerts content type.

Stellar Cyber maps Microsoft Defender for Cloud Apps alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid and microsoft_defender_for_cloud_apps._id.

Microsoft Entra ID (formerly Azure AD)

riskDetections>riskEvents

Microsoft Entra ID (formerly Azure AD) Connector

This connector can ingest several log types. Only Risk Detection logs are relevant to alert mapping.

Select the Risk Detection Collection content type.

The value in the fields for the data type noted at left are mapped to Stellar Cyber's XDR Alert index. These alerts are suitable for MITRE | ATT&CK classification, but do not contain tactic and technique values. Stellar Cyber has evaluated each possible alert and assigned a corresponding MITRE | ATT&CK Stage, Tactic and Technique.

Deduplication is by tenantid, riskEventType, riskLevel, userDisplayName, and ipAddress.

Microsoft Office 365

Windows Events

Office 365 Connectors

This connector ingests logs from Microsoft Office 365.

Select the Audit General content type.

Only the AlertTriggered operation is relevant to alert mapping.

Stellar Cyber maps Microsoft Office 365 alerts from the AlertTriggered operation.

For the Audit General content type, Office 365 alerts contain events from the AlertTriggered operation, which are sent to the Alerts index.

The source records may also include related events in the AlertEntityGenerated operation. Some information (AlertEntityId and EntityType) from the AlertEntityGenerated operation is merged with the AlertTriggered operation for the same Alert ID. The information (AlertEntityId and EntityType) is stored in the event_summary field.

Deduplication is by tenantid and AlertId.
  • msg_origin.source Interflow field to which Stellar Cyber assigns a vendor identifying value, which can be used for filtering.:office365

  • msg_class Interflow field to which Stellar Cyber assigns a value, which can be used for filtering.: office365_audit_general

  • Alert Subtype: event.threat.name or office365.Name

  • Event (Alert) Name Interflow field: xdr_event.display_name: Microsoft 365: with the assigned Technique Technique includes both those based on the MITRE | ATT&CK framework, as well as native XDR versions developed by Stellar Cyber, which will be used only when there is no available Mitre technique. and the assigned (Tactic), for example Microsoft 365: Valid Accounts (Privilege Escalation)

  • Fidelity Interflow field: fidelity: Is Severity by default

  • Severity Interflow field: severity or event.severity: Derived from Office 365 alert policy Severity event.severity_str:

    • High: 75

    • Medium: 55

    • Low: 35

    • Informational: 15

  • Kill Chain & MITRE | ATT&CK values are mapped to the Office 365 alert policies and the category to which each policy is assigned. You can also refer to the Microsoft documentation.

    Categories and Alerts

    Tactic

    Technique

    		 Severity
    Information governance:      

    • Unusual external user file activity

    Impact/Exfiltration

    		Data Destruction, Exfiltration Over Web Service High

    • Unusual volume of external file sharing

    Exfiltration

    		Exfiltration Over Web Service Medium

    • Unusual volume of file deletion

    Impact

    		Data Destruction Medium
    Mail flow:      

    • Messages have been delayed

    XDR NBA

    		 XDR Rule Violation High
    Permissions:      

    • Elevation of Exchange admin privilege

    Privilege Escalation

    		Valid Accounts Low
    Threat management:      

    • A potentially malicious URL click was detected

    Initial Access

    		Phishing High

    • A user clicked through to a potentially malicious URL

    Initial Access

    		 Phishing High

    • Admin submission result completed

    XDR UBA

    		 XDR Anomaly Info

    • Admin triggered manual investigation of email

    XDR UBA

    		 XDR Anomaly Info

    • Admin triggered user compromise investigation

    XDR UBA

    		 XDR Suspicious User Medium

    • Administrative action submitted by an Administrator

    XDR UBA

    		 XDR Anomaly Info

    • Creation of forwarding/redirect rule

    		 Collection Email Collection Info

    • eDiscovery search started or exported

    		 Discovery Account Discovery Info

    • Email messages containing malicious file removed after delivery

    Initial Access

    		Phishing Info

    • Email messages containing malicious URL removed after delivery

    Initial Access

    		Phishing Info

    • Email messages containing malware removed after delivery

    Initial Access

    		Phishing Info

    • Email messages containing phish URLs removed after delivery

    Initial Access

    		Phishing Info

    • Email messages from a campaign removed after delivery

    Initial Access

    		Phishing Info

    • Email messages removed after delivery

    Initial Access

    		Phishing Info

    • Email reported by user as malware or phish

    Initial Access

    		Phishing Low

    • Email sending limit exceeded

    Initial Access

    		Valid Accounts Medium

    • Form blocked due to potential phishing attempt

    		 Lateral Movement Internal Spearphishing High

    • Form flagged and confirmed as phishing

    Initial Access

    		Phishing High

    • Malware not zapped because ZAP is disabled

    Initial Access

    		Phishing Info

    • Messages containing malicious entity not removed after delivery

    Initial Access

    		Phishing Medium

    • Phish delivered because a user's Junk Mail folder is disabled

    Initial Access

    		Phishing Info

    • Phish delivered due to an ETR override

    Initial Access

    		Phishing Info

    • Phish delivered due to an IP allow policy

    Initial Access

    		Phishing Info

    • Phish not zapped because ZAP is disabled

    Initial Access

    		Phishing Info

    • Potential nation-state activity

    		 Initial Access Valid Accounts High

    • Remediation action taken by admin on emails or URL or sender

    Initial Access

    		Phishing Info

    • Suspicious connector activity

    Initial Access

    		Phishing High

    • Suspicious email forwarding activity

    		 Collection Email Collection High

    • Suspicious email sending patterns detected

    		 Initial Access Valid Accounts Medium

    • Suspicious tenant sending patterns observed

    		 Privilege Escalation Valid Accounts High

    • Tenant Allow/Block List entry is about to expire

    		 XDR UBA XDR Policy Anomaly Info

    • Tenant restricted from sending email

    		 Privilege Escalation Valid Accounts High

    • Tenant restricted from sending unprovisioned email

    		 Initial Access Valid Accounts High

    • User requested to release a quarantined message

    		 Initial Access Valid Accounts Info

    • User restricted from sending email

    		 Initial Access Valid Accounts High

    • User restricted from sharing forms and collecting responses

    		 Lateral Movement Internal Spearphishing High

Microsoft Sentinel

Microsoft Sentinel incidents

Refer to Incidents.

Azure Event Hub Connector

This connector ingests logs from the content type, Microsoft Sentinel, to get the raw alerts that are stored in the Syslog index.

Stellar Cyber maps Microsoft Sentinel incidents. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid and microsoft_sentinel.IncidentName.

Mimecast

Mimecast alerts

There are the following types of alerts:

  • Mimecast Attachment Protect safeguards against spear phishing and other targeted attacks using email attachments

  • Mimecast AV/AntiVirus protects users by checking the content again for new malware released

  • Mimecast Impersonation Protect defends against emails that impersonate people and brands

  • Mimecast Internal Email Protect detects email-related security threats that originate from within an email system

  • Mimecast Malicious Receipt Log is Mail Transfer Agent (MTA) data that contains a virus found by Mimecast

  • Mimecast URL Protect blocks malicious URLs

Refer to "Log Field Descriptions" in Understanding SIEM Logs: Targeted Threat Protection - Attachment Protect logs, AV logs, Targeted Threat Protection - Impersonation Protect logs, Target Threat Protection - Internal Email Protect logs, Receipt logs, Targeted Threat Protection - URL Protect logs

Mimecast Connector

This connector ingests logs from Mimecast to get the raw alerts that are stored in the Syslog index.

Select the MTA Log content type.

Stellar Cyber maps Mimecast alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by the following fields:

  • Attachment Protect and AV/AntiVirus—tenantid, srcip, file.hash.md5, email.sender.address, and email.recipient.addresses.

  • Impersonation Protect, Internal Email , and Malicious Receipt—tenantid and mimecast.aCode.

  • URL Protect—tenantid, srcip, url, email.sender.address, and email.recipient.addresses.

Netskope

Netskope Alerts

The following types are supported:

  • Netskope Alert (Breach)

  • Netskope Alert (Connection)

  • Netskope Alert (Malsite)

Netskope Connector

This connector ingests logs from Netskope to get the raw alerts that are stored in the Syslog index.

Select the Alert content type.

Stellar Cyber maps Netskope alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by the following fields:

  • Breach—tenantid, user.name, and netskopewsg.breach_id.

  • Connection—tenantid, user.name, and netskopewsg.connection_id.

  • Malsite—tenantid, user.name, and netskopewsg.malsite_id.

Oracle Cloud Infrastructure (OCI) CloudGuard

OCI CloudGuard Alerts

Refer to OCI CloudGuard.

OCI Streaming Connector

This connector ingests logs from OCI to get the raw alerts that are stored in the Syslog index.

Stellar Cyber maps OCI CloudGuard alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid, oracle.data.additionalDetails.tenantId, event.threat.name, and cloud.resource.id.

Alerts from OCI CloudGuard are not correlated into cases in Case Management.

Proofpoint Targeted Attack Protection (TAP)

Proofpoint TAP Alerts

There are the following categories of alerts:

  • Phish: Phishing is when attackers send malicious emails designed to trick people into falling for a scam. Typically, the intent is to get users to reveal financial information, system credentials or other sensitive data.

  • Imposter: A scammer sets up an email address that looks like it is from your company. Then the scammer sends out messages using that email address. This practice is called spoofing, and the scammer is what we call a business email imposter.

  • Malware: Malware is a common cyber attack and an umbrella term for various malicious programs delivered and installed on end-user systems and servers. These attacks are designed to cause harm to a computer, server, or computer network, and are used by cyber criminals to obtain data for financial gain

  • Toad (Telephone-Oriented Attack Delivery): Toad is a type of social engineering attack that lures potential victims to contact fraudulent call centers managed by threat actors in attempts to steal credentials or install malware onto their systems.

  • Spam: Email spam, also known as junk email, refers to unsolicited email messages, usually sent in bulk to a large list of recipients.

Proofpoint TAP Connector

This connector ingests logs from Proofpoint TAP to get the raw alerts that are stored in the Syslog index.

Select the Events content type.

Stellar Cyber maps Proofpoint TAP alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by email.from.address and email.sender.address.

There are the following event types:

  • Proofpoint TAP messageBlocked

  • Proofpoint TAP messageDelivered

  • Proofpoint TAP clickBlocked

  • Proofpoint TAP clickDelivered

SentinelOne Cloud

Threats

SentinelOne Connector 

This connector can ingest Hosts, Threats, and Vulnerabilities. Of these, only Threats are relevant for alert mapping.

Select the Threats content type.

The threat dataset includes a variety of fields that enable Stellar Cyber to map the native SentinelOne alerts to the Stellar Cyber alert index. For example, threatInfo.classification describes the event (such as Trojan). That and other fields in the threatInfo record support direct mapping of SentinelOne's MITRE | ATT&CK Tactic and Technique fields to Stellar Cyber's XDR Kill Chain.

Deduplication is by org_id, tenantid, host.name, host.ip, file.name, file.path, and process.parent.name.

SentinelOne alerts are also deduplicated, for example, if a previously created alert is updated. This type of deduplication avoids old alerts being resent.

Sophos Central

Sophos Alerts and Sophos Events

Sophos Central Connector

This connector ingests logs from Sophos Central to get the raw alerts that are stored in the Syslog index.

Select the Alerts and Events content types.

Stellar Cyber maps Sophos alerts and events. The alerts and events are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid and sophos.id.

The subtype uses sophos.type. Only Endpoint-related alerts and events are integrated.

Trellix (FireEye) Endpoint Security

Alerts

Trellix (FireEye) Endpoint Security HX

The connector can be used for three data types but only Alerts are applicable for alert mapping.

Select the Alerts content type.

Stellar Cyber identifies the FireEye data logged into the Syslog index. Records of the type Alerts are then normalized, enriched, and mapped to the Alerts index. The following fields are included as part of the Stellar Cyber alert description: indicator.name and agent.url. Each relevant Syslog record is compared against existing records in the Alert index and not added to that index if the values in the following fields match those of an existing record logged in the previous 24 hours: org_id, tenantid, user.name, host.ip, event.name, file.path, process.path.

The following four alert types are supported: IOC, MAL, AMSI, and PROCGUARD. Tactic and Technique are based on alert type.

Deduplication is by the following fields:

  • AMSI—tenantid, host.ip, host.name, event.url, and event.threat.name.

  • IOC—tenantid, user.name, host.ip, host.name, event.name, file.path, and process.executable.

  • MAL—tenantid, host.ip, host.name, event.url, and file.path.

  • PROCGUARD—tenantid, host.ip, host.name, event.url, and event.threat.name.

Trend Micro Vision One

Trend Micro Vision One Alerts

Trend Micro Vision One Connector

This connector ingests logs from Trend Micro Vision One to get the raw alerts that are stored in the Syslog index.

Select the Alerts content type.

Stellar Cyber maps Trend Micro Vision One alerts. The alerts are read from the Syslog index, enriched with Stellar Cyber fields, and mapped (with deduplication) to the Alerts index.

Deduplication is by tenantid and trendmicro_visionone.workbenchId.

Tactic and Technique are provided by the Trend Micro Vision One raw alerts field trendmicro_visionone.matchedRules.

Varonis DatAdvantage

Varonis Alerts

  • File system operation

  • Directory services operation

Configure ingestion of CEF format logs to a Stellar Cyber sensor.

Varonis sends Syslog CEF events to Stellar Cyber, which maps Varonis DatAdvantage alerts to the Alerts index.

Deduplication is by tenantid, user.name, file.name, file.path, and event.threat.name.

To search the alerts in the Alerts index or to search the Original Records in the Syslog index, use the query:

  • msg_class: (varonis_datadvantage_file_system_operation or varonis_datadvantage_directory_services_operation)

VMware Carbon Black Cloud

Alerts of type CB Analytics, Device Control, and Watchlist

VMware Carbon Black Cloud Connector

Select the Alert content type.

VMware Carbon Black alerts are assigned a MITRE technique / tactic / procedure (TTP) which is reformatted but otherwise preserved during mapping, except as noted below.

CB Analytics and Device Control:

  • Alerts with a threat_cause_threat_category of NON_MALWARE, NEW_MALWARE, and KNOWN_MALWARE are directly mapped to the Alerts index. The kill_chain_status values (RECONNAISSANCE, WEAPONIZE, DELIVER_EXPLOIT, INSTALL_RUN, COMMAND_AND_CONTROL, EXECUTE_GOAL, BREACH) are preserved and mapped to the Stellar Cyber XDR Kill Chain.

  • Alerts with a threat category value of RISKY_PROGRAM are assigned a Tactic of XDR Malware and Techinque of XDR PUA.

  • Alerts with threat category value of UNKNOWN are run through Stellar Cyber's ML/SA pipeline, to better ascertain the nature of the alert before mapping it to the Alert index. This type is assigned an Tactic of XDR EBA and Technique of XDR Anomaly

Watchlist: This type of alert is considered noisy (generates a large volume of hits), so it is routed through the ML/SA pipeline using our Time Series Analytic and Rare models, along with deduplication, before being mapped to the Alerts index. This type of alert is classified as Tactic: XDR EBA with Technique: XDR Anomaly.

Deduplication is by org_id, tenantid, event.type, host.external_ip, host.ip, process.name, event.description_id, and file.name.

VMware Carbon Black alerts are also deduplicated, for example, if a previously created alert is updated. This type of deduplication avoids old alerts being resent.

ORIGINAL FIELDS: In addition to the mapping of fields to Stellar Cyber Interflow fields, all of the original fields for this alert type are included in the Interflow record.

Windows Defender Antivirus

(free version only)

Events

Windows Agent Detection Logs ingested from a Windows Agent

These events are ingested to the Stellar Cyber Windows Event index. As of the v4.3.2 release, they are also now processed into the Alerts index. In these logs, multiple events correlate to a single case, such as event_id 1116 (malware detected), one with event_id 1117 (means malware is quarantined). Stellar Cyber manages this, tracking the events to the related case during the mapping process.

Deduplication is by tenantid, event.ms_incident_id, threat, and file.path.

To search the events in the Alerts index or to search the Original Records in the Syslog index, use the query:

  • msg_class:\"Microsoft-Windows-Windows Defender\" AND _exists_: event.ms_incident_id.keyword"