Zero hit analysis system
In one embodiment, a device includes a processor configured to receive a given rule from a service, the given rule including multiple statements, identify a zero-hit statement being a statement of the multiple statements of the given rule causing zero hits against the log data, and perform an action responsively to identifying the zero-hit statement.
1 . A device, comprising:
a processor configured to:
receive a given rule from a detection service, the given rule including multiple statements separated by separators, wherein each statement defines a condition to be checked against log data;
generate multiple test rules from the given rule, wherein each test rule includes a different number of statements taken in order from the beginning of the given rule;
identify a zero-hit statement being a statement of the multiple statements of the given rule causing zero hits against the log data, wherein the zero-hit statement is identified as a last statement of a shortest test rule yielding zero hits against the log data; and
perform an action responsively to identifying the zero-hit statement; and
a memory configured to store data used by the processor.
2 . The device according to claim 1 , wherein the processor is configured to:
provide the test rules to the service to run each of the test rules against log data;
receive a number of hits against the log data for each of the test rules; and
identify the zero-hit statement based on one of the test rules yielding zero hits against the log data.
3 . The device according to claim 2 , wherein the processor is configured to identify the zero-hit statement as a first statement of the multiple statements of the given rule causing zero hits against the log data based on one of the test rules yielding zero hits against the log data.
4 . The device according to claim 2 , wherein:
the processor is configured to generate the test rules so that one of the test rules includes a first N statements of the multiple statements of the given rule, and another one of the test rules includes a first M statements of the multiple statements of the given rule, N being different to M;
the number of hits against the log data for any one of the test rules indicates a contribution of a last statement of the one test rule; and
the processor is configured to identify the zero-hit statement based on the last statement of a shortest one of the test rules yielding zero hits against the log data.
5 . The device according to claim 4 , wherein the processor is configured to select the test rules to be provided to the service using a binary search algorithm.
6 . The device according to claim 4 , wherein the processor is configured to rule out at least one of the statements in the given rule as being the zero-hit statement based on a preliminary analysis of the given rule.
7 . The device according to claim 4 , wherein the processor is configured to reorder, in at least some of the test rules, sub-statements of one statement selected from the multiple statements of the given rule.
8 . The device according to claim 1 , wherein the service is a security information and event management (SIEM) service, and the given rule is a SIEM correlation rule.
9 . The device according to claim 1 , wherein the processor is configured to:
check whether the zero-hit statement caused non-zero hits last time the given rule was tested by the processor; and
check whether the given rule has been amended since the last time the given rule was tested by the processor.
10 . The device according to claim 1 , wherein the processor is configured to correct the zero-hit statement of the given rule.
11 . The device according to claim 10 , wherein the processor is configured to test the corrected rule using additional test rules generated from the statements of the corrected rule to check that the corrected rule has been fixed.
12 . The device according to claim 1 , wherein the processor is configured to provide an alert indicating any one or more of the following: the zero-hit statement that is causing zero hits against the log data; that the given rule is broken; to check that the service is receiving log data related to the zero-hit statement.
13 . A method, comprising:
receiving a given rule from a detection service, the given rule including multiple statements separated by separators, wherein each statement defines a condition to be checked against log data;
generating multiple test rules from the given rule, wherein each test rule includes a different number of statements taken in order from the beginning of the given rule;
identifying a zero-hit statement being a statement of the multiple statements of the given rule causing zero hits against the log data, wherein the zero-hit statement is identified as a last statement of a shortest test rule yielding zero hits against the log data; and
performing an action responsively to identifying the zero-hit statement.
14 . The method according to claim 13 , further comprising:
providing the test rules to the service to run each of the test rules against log data; and
receiving a number of hits against the log data for each of the test rules, and wherein the identifying includes identifying the zero-hit statement based on one of the test rules yielding zero hits against the log data.
15 . The method according to claim 14 , wherein the identifying includes identifying the zero-hit statement as a first statement of the multiple statements of the given rule causing zero hits against the log data based on one of the test rules yielding zero hits against the log data.
16 . The method according to claim 14 , wherein:
the generating includes generating the test rules so that one of the test rules includes a first N statements of the multiple statements of the given rule, and another one of the test rules includes a first M statements of the multiple statements of the given rule, N being different to M;
the number of hits against the log data for any one of the test rules indicates a contribution of a last statement of the one test rule; and
the identifying includes identifying the zero-hit statement based on the last statement of a shortest one of the test rules yielding zero hits against the log data.
17 . The method according to claim 16 , further comprising selecting the test rules to be provided to the service using a binary search algorithm.
18 . The method according to claim 16 , further comprising ruling out at least one of the statements in the given rule as being the zero-hit statement based on a preliminary analysis of the given rule.
19 . The method according to claim 16 , further comprising reordering, in at least some of the test rules, sub-statements of one statement selected from the multiple statements of the given rule.
20 . The method according to claim 13 , wherein the service is a security information and event management (SIEM) service, and the given rule is a SIEM correlation rule.
21 . The method according to claim 13 , further comprising:
checking whether the zero-hit statement caused non-zero hits last time the given rule was tested; and
checking whether the given rule has been amended since the last time the given rule was tested.
22 . The method according to claim 13 , further comprising correcting the zero-hit statement of the given rule.
23 . The method according to claim 22 , further comprising testing the corrected rule using additional test rules generated from the statements of the corrected rule to check that the corrected rule has been fixed.
24 . The method according to claim 13 , further comprising providing an alert indicating any one or more of the following: the zero-hit statement that is causing zero hits against the log data; that the given rule is broken; to check that the service is receiving log data related to the zero-hit statement.
25 . A software product, comprising a non-transient computer-readable medium in which program instructions are stored, which instructions, when read by a central processing unit (CPU), cause the CPU to:
receive a given rule from a detection service, the given rule including multiple statements separated by separators, wherein each statement defines a condition to be checked against log data;
generate multiple test rules from the given rule, wherein each test rule includes a different number of statements taken in order from the beginning of the given rule;
identify a zero-hit statement being a statement of the multiple statements of the given rule causing zero hits against the log data, wherein the zero-hit statement is identified as a last statement of a shortest test rule yielding zero hits against the log data; and
perform an action responsively to identifying the zero-hit statement.