Improved Correlations and Search

Correlations help you detect security weaknesses or threats for further investigation and response from custom logic you create to meet the specific security needs of your company or the accounts you manage. The improved correlation experience allows you to create powerful custom rules with similar syntax structure as Search queries in the Get Started with Search page of the Alert Logic console. When you create a correlation rule, Alert Logic examines data as it is collected for matching patterns based on the correlation alert you created and will trigger an incident or an alert.

When to create a correlation

Correlations are specific sets of custom rules that you can create to be notified or alerted when the data Alert Logic receives matches the pattern for the data you specified in the correlation. Correlations allows you to be notified or alerted for incidents or observations outside of what Alert Logic already generates in the Incidents page. The correlations features allows for an extra layer of protection that your organization can actively and internally monitor. For example, if your organization has a custom-built internal application or software, you can create a correlation rule to be notified when a new user logs into your application or when files are moved or deleted in your application. Other examples of correlations you can create are for user login failures that occur more than five times in ten minutes, deny logs that block certain requests, and installation of a new program on your domain controller.

You can configure the correlation rule to generate a FIM notification, an observation notification, or an incident notification. Specific examples of the types of notifications and alerts you can create a correlation for are:

• Incident notification alerts about a correlation for an administrative user that logs into your production data center
• FIM notification alerts about a correlation for sensitive files that were moved or deleted by a user that is not authorized to access those files
• Observation notification about a correlation that provides valuable security information (a failed administrative user login, for example), but you do not consider it as severe as an incident.

Start creating a correlation

Alert Logic recommends creating the correlation from the Search page from a valid search query. After you develop and validate a query (see Get Started with Search), you can choose to create a correlation based on the query. Alert Logic then applies the query to the correlation for you.

You can also create a correlation from the Correlations page or the Notifications page. Whichever method you choose, the process is similar after you open the Create a Correlation page.

To create a correlation from the Search page:

1. In the Alert Logic console, click the menu icon ().
2. Click Investigate, and then click Search.
3. On the Search page, click the Search tab.
4. Create a valid log search query to define the correlation conditions. For examples of correlation queries, see Examples of Search Correlation Queries.
5. Click the SEARCH drop-down menu below the query, and then click Create Correlation.
6. Complete the fields in the Create a Correlation page. Alert Logic adds the log search query to the correlation, which you can change.

To create a correlation from the Correlations page:

1. In the Alert Logic console, click the menu icon ().
2. Click Investigate, click Search, and then click the Correlations tab.
3. On the Correlations page, click the add icon ().
4. Select Search (Guided Mode).
5. Complete the fields in the Create a Correlation page.

To complete the Create a Correlation page:

1. Type a descriptive name for the correlation—for example, "Admin Failed Login."
2. If you want the correlation to be active, leave Correlation Is Active turned on. If you want to save the definition but not activate the correlation yet, turn it off.
3. If you did not already create a search query for the correlation, or if you want to adjust a displayed query, click EDIT IN SEARCH, and then create or edit the query. For examples of correlation queries, see Examples of Search Correlation Queries.
4. (Optional) For a search query that includes the INTERVAL function, adjust the number of minutes or hours in the Time Frame window as needed. The minimum window is one minute and the maximum is 24 hours. Time frame settings do not appear if they are not applicable to your search query.
Alert Logic generates a correlation if conditions occur within the time frame window and do not exceed the number of occurrences listed in the Suppression setting. The window begins when correlation conditions trigger a unique combination of values in the query SELECT statement.
5. Specify the generating option for messages that meet the correlation conditions:
   • Observation—If you want Alert Logic to inform you about the correlation but not generate an incident, click Observation.
   • Incident—If you want Alert Logic to generate an incident, click Incident.
6. Select one of the following Suppression options to reduce repeated triggers:
• Limit generation to once per hour
• Limit generation to once per 6 hours
• Limit generation to once per 24 hours
• Limit generation to once per week

Suppression occurs if the same unique combination of values in the SELECT statement of the correlation query triggers an observation or incident within the specified time. Alert Logic generates at most 300 incidents or observations per rule in any consecutive 24-hour period.

If you configure failed user logins to trigger a correlation and you limit incident generation to once per hour, Alert Logic generates only one incident for a specific user login failure during the hour. If login failures occur for multiple users in an hour, Alert Logic generates an incident for each user (up to 300 incidents in 24 hours).
7.  Add details about the observation or incident that the correlation will generate. See the relevant procedures below:
   • Finish setting up an observation for a correlation
   • Finish setting up an incident for a correlation

Finish setting up an observation for a correlation

To finish setting up the observation that results from the correlation, add details about the correlation to help analysts quickly understand the problem, and then save your correlation.

1. Add details about the observation:
   • Observation Summary—Type descriptive text to summarize the observation.
   • Attacker—(Optional) Select the query field that identifies the suspected attacker.
   • Target—(Optional) Select the query field that identifies the target of the attack.
   • Description—To describe the observation, type descriptive text, insert one or more fields from the query (type the % character to see a list), or both. Field names must be enclosed with % characters. You can use Markdown syntax to format the text.
2. Click SAVE AND CONTINUE. A page for creating the notification opens with the correlation already added as a filter. For information about setting up the notification, see Observation Notifications.

Finish setting up an incident for a correlation

To finish setting up the incident that results from the correlation, add details about the correlation to help analysts quickly understand the problem. Then you need to choose whether to set up an incident notification and save your correlation.

1. Add details about the incident:
   • Incident Summary—Type descriptive text to summarize the incident.
   • Attacker—(Optional) Select the query field that identifies the suspected attacker.
   • Target—(Optional) Select the query field that identifies the target of the attack.
   • Investigation Report——Add information to help with incident investigation. You can type descriptive text, insert one or more fields from the query, or both. Enclose field names with % characters. You can use Markdown syntax to format the text.
   • Recommendations—(Optional) Add a recommended response to the incident. You can type descriptive text, insert one or more fields from the query, or both. Enclose field names with % characters. You can use Markdown syntax to format the text.
2. Specify whether to send a notification when the correlation conditions generate an incident:
   • To send a notification, turn on Create Incident Notification in Next Step, and then click SAVE AND CONTINUE. A page for creating the notification opens with the correlation already added as a filter. For more information about setting up the notification, see Create an incident notification.
   • To generate the incident but not send a notification, leave Create Incident Notification in Next Step turned off, and then click SAVE.

View and manage correlations

The Correlations page lists your existing correlations. You can create, preview, and manage correlations from this page.

To narrow the set of correlations listed, you can use the filters in the left navigation. You can also group and sort the correlations with tools available toward the top of the page.

To access the Correlations page, from the Search page, click the Correlations tab.

You can click Preview next to a specific correlation to see its details and manage the correlation.

Filter the correlations list

The Correlations page displays all active correlations created from the customer account and its managed accounts. You can also display inactive correlations and apply additional filters to narrow the list to a specific set of correlations.

To filter the correlations list:

1. In the left navigation, click the correlation status of interest:
   • Active
   • Inactive (correlation is saved but not turned on)
2. To further narrow the list to show only incident or observation correlation types, click Incidents or Observations.
3. To clear filters and start over, delete any text you typed in Search filters or select CLEAR ALL FILTERS.

Organize the correlations list

You can organize the correlations list by grouping and sorting the correlations. Alert Logic groups your correlations by correlation type and sorts them by date last triggered within each grouping. You can group and sort the notifications by other criteria to suit your needs.

To organize your correlations:

1. To change the grouping, click Group by, and then click the option you want. Available options match the filters listed in the left panel.
2. To change the way the list is sorted within each grouping, click Sort by, and then click the option you want. Available options include:
   • Last Triggered
   • Alphabetically
   • Creation Date
   • Last Modified Date

Search the correlations list

You can use the search bar to filter the list to include only correlations that contain specific words in important fields, like name.

View and manage correlations from the detail view

You can view the details about a specific correlation. The detail view indicates the last time the correlation was triggered, the date the correlation was created and last modified, the log search query, and other details about the correlation that can help you understand the correlation and respond to it quickly.

For an incident correlation type, the view includes the number of open incidents generated by the correlation and a RESPOND link, which accesses the Incident List filtered to show incidents generated by the correlation.

From the detail view, you can also view the list of notifications that will be sent when correlation conditions are met, add a notification, edit the correlation, or delete it.

To view details about a correlation:

1. From the Search page, click the Correlations tab.
2. To the right of the correlation you want to view, click Preview.
3. When you are finished viewing correlation details, click Hide.

To add a notification to a correlation:

1. From the Search page, click the Correlations tab.
2. To the right of the correlation for which you want to set up a notification, click Preview.
3. Toward the bottom of the detail view, click +ADD. A page for creating the notification opens with the correlation already added as a filter. For information about setting up the notification, see the relevant information:
   • Finish setting up an incident for a correlation
   • Finish setting up an observation for a correlation

To delete a correlation:

1. From the Search page, click the Correlations tab.
2. To the right of the correlation you want to delete, click Preview.
3. Toward the bottom of the detail view, click the DELETE icon.

To edit a correlation:

1. From the Search page, click the Correlations tab.
2. To the right of the correlation you want to edit, click Preview.
3. Toward the bottom of the detail view, click the EDIT icon.
4. In the Edit a Correlation page, change any of the settings. You can:
   • Make the correlation active or inactive
   • Change the correlation search query
   • Change the correlation type
   • Change the suppression option
   • Edit the details that explain the problem (summary, attacker, and so on)
   • Add a notification

To open a list of incidents generated by the correlation:

1. From the Search page, click the Correlations tab.
2. To the right of the notification, click Preview.
3. Toward the top of the detail view, click RESPOND >. For more information about incidents and responding to them, see Incidents.