Automated security rule updates based on alert feedback
Aspects of the disclosure are directed to systems, method, and computer-readable mediums for reducing the number of false positive alerts generated by a SIEM system by adjusting the set of rules the SIEM system uses to analyze attributes of the network traffic and/or system activities based on feedback from a SOAR system. Alert feedback may be received for a set of alerts generated in response to attributes triggering one or more rules. The alert feedback may indicate, for each alert of the set of alerts, whether the alert was a true positive alert or false positive alert. One or more conditions of the at least one rule may be adjusted based on the feedback.
1 . A computer-implemented method comprising:
receiving, by one or more processors, alert feedback for a set of alerts generated in response to attributes triggering one or more rules, the alert feedback indicating, for each alert of the set of alerts, whether the respective alert was a true positive alert or false positive alert; and
determining, by the one or more processors based on the alert feedback, a first rule of the one or more rules that generated a set of true positive alerts and a set of false positive alerts;
determining, by the one or more processors, a first subset of the attributes that triggered the first rule to generate the set of true positive alerts;
determining, by the one or more processors, a second subset of the attributes that triggered the first rule to generate the set of false positive alerts; and
adjusting, by the one or more processors, one or more conditions of the first rule by splitting the first rule into two experimental rules, wherein one of the experimental rules contains a first subset of conditions based on the first subset of attributes and the other of the experimental rules contains a second subset of conditions based on the second subset of attributes.
2 . The method of claim 1 , further comprising:
determining, by the one or more processors based on the alert feedback, a second rule of the one or more rules that generated a set of true positive alerts without any false positive alerts;
determining, by the one or more processors, a third subset of the attributes that triggered the second rule to generate the set of true positive alerts without any false positive alerts; and
adjusting, by the one or more processors, one or more conditions of the second rule such that the second rule is triggered only when the third subset of attributes are present in network traffic or system activities.
3 . The method of claim 1 , further comprising:
determining, by the one or more processors based on the alert feedback, a second rule of the one or more rules that generated a set of false positive alerts without any true positive alerts;
determining, by the one or more processors, a third subset of the attributes that triggered the second rule to generate the set of false positive alerts without any true positive alerts; and
adjusting, by the one or more processors, one or more conditions of the second rule by adding inverse conditions based on the third subset of attributes to prevent the second rule from triggering when the third subset of attributes are present in network traffic or system activities.
4 . The method of claim 1 , further comprising monitoring, by the one or more processors, alert feedback for the two experimental rules.
5 . The method of claim 1 , wherein the set of alerts are generated by a security information event management (SIEM) system.
6 . The method of claim 1 , wherein a security orchestration, automation, and response (SOAR) system provides the alert feedback.
7 . The method of claim 1 , wherein the one or more conditions correspond to one or more attributes assessed by the first rule.
8 . The method of claim 4 , further comprising:
determining, by the one or more processors based on the alert feedback for the two experimental rules, that the two experimental rules are generating a greater proportion of true positive to false positive alerts than the first rule; and
maintaining, by the one or more processors, the two experimental rules.
9 . The method of claim 4 , further comprising:
determining, by the one or more processors based on the alert feedback for the two experimental rules, that the two experimental rules are generating an equal to or less than proportion of true positive to false positive alerts than the first rule; and
merging, by the one or more processors, the two experimental rules back into the first rule.
10 . A system comprising:
one or more computing devices executing a security information event management (SIEM) system, wherein the one or more computing devices comprise memory and one or more processors, and
wherein the SIEM system is configured to:
receive alert feedback for a set of alerts generated in response to attributes triggering one or more rules, the alert feedback indicating, for each alert of the set of alerts, whether the respective alert was a true positive alert or false positive alert;
determine, based on the alert feedback, a first rule of the one or more rules that generated a set of true positive alerts and a set of false positive alerts;
determine a first subset of the attributes that triggered the first rule to generate the set of true positive alerts;
determine a second subset of the attributes that triggered the first rule to generate the set of false positive alerts; and
adjust one or more conditions of the first rule by splitting the first rule into two experimental rules, wherein one of the experimental rules contains a first subset of conditions based on the first subset of attributes and the other of the experimental rules contains a second subset of conditions based on the second subset of attributes.
11 . The system of claim 10 , wherein the SIEM system is further configured to:
determine, based on the alert feedback, a second rule of the one or more rules that generated a set of true positive alerts without any false positive alerts;
determine a third subset of the attributes that triggered the second rule to generate the set of true positive alerts without any false positive alerts; and
adjust one or more conditions of the second rule such that the second rule is triggered only when the third subset of attributes are present in network traffic or system activities.
12 . The system of claim 10 , wherein the SIEM system is further configured to:
determine, based on the alert feedback, a second rule of the one or more rules that generated a set of false positive alerts without any true positive alerts;
determine a third subset of the attributes that triggered the second rule to generate the set of false positive alerts without any true positive alerts; and
adjust one or more conditions of the second rule by adding inverse conditions based on the third subset of attributes to prevent the second rule from triggering when the third subset of attributes are present in network traffic or system activities.
13 . The system of claim 12 , wherein the SIEM system is further configured to monitor alert feedback for the two experimental rules.
14 . The system of claim 10 , further comprising a security orchestration, automation, and response (SOAR) system.
15 . The system of claim 14 , wherein the SOAR system is configured to provide the alert feedback.
16 . The system of claim 10 , wherein the one or more conditions correspond to one or more attributes assessed by the first rule.
17 . A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
receive alert feedback for a set of alerts generated in response to attributes triggering one or more rules, the alert feedback indicating, for each alert of the set of alerts, whether the alert was a true positive alert or false positive alert;
determine, based on the alert feedback, a first rule of the one or more rules that generated a set of true positive alerts and a set of false positive alerts;
determine a first subset of the attributes that triggered the first rule to generate the set of true positive alerts;
determine a second subset of the attributes that triggered the first rule to generate the set of false positive alerts; and
adjust one or more conditions of the first rule by splitting the first rule into two experimental rules, wherein one of the experimental rules contains a first subset of conditions based on the first subset of attributes and the other of the experimental rules contains a second subset of conditions based on the second subset of attributes.
18 . The non-transitory computer-readable medium of claim 17 , wherein the instructions further cause the one or more processors to:
determine, based on the alert feedback, a second rule of the one or more rules that generated a set of true positive alerts without any false positive alerts;
determine a third subset of the attributes that triggered the second rule to generate the set of true positive alerts without any false positive alerts; and
adjust one or more conditions of the second rule such that the second rule is triggered only when the third subset of attributes are present in network traffic or system activities.
19 . The non-transitory computer-readable medium of claim 17 , wherein the instructions further cause the one or more processors to:
determine, based on the alert feedback, a second rule of the one or more rules that generated a set of false positive alerts without any true positive alerts;
determine a third subset of the attributes that triggered the second rule to generate the set of false positive alerts without any true positive alerts; and
adjust one or more conditions of the second rule by adding inverse conditions based on the third subset of attributes to prevent the second rule from triggering when the third subset of attributes are present in network traffic or system activities.