refactor(sonicwall): revamp filter and correlation rules

rules/sonicwall/sonicwall_firewall/anti_spyware_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,23 +14,26 @@ references:
   - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
   - https://attack.mitre.org/techniques/T1082/
 description: |
-  Detects when SonicWall Anti-Spyware service identifies and blocks spyware, adware, or other potentially unwanted programs (PUPs) that may be attempting to collect sensitive information or establish persistence on the network.
+  Detects when SonicWall Anti-Spyware service identifies and blocks spyware,
+  adware or other potentially unwanted programs (PUPs) that may be attempting
+  to collect sensitive information or establish persistence on the network.
 
   Next Steps:
-  - Review the detected spyware category and priority level
-  - Investigate the source IP address for other malicious activities
-  - Check if the blocked spyware represents a targeted attack or widespread infection
-  - Verify that Anti-Spyware policies are properly configured and up-to-date
-  - Consider quarantining the affected host if multiple spyware detections occur
-  - Review network traffic patterns from the source to identify potential data exfiltration
+  - Review the detected spyware category and priority level.
+  - Investigate the source IP for other malicious activities.
+  - Check whether the blocked spyware represents a targeted attack or a
+    widespread infection.
+  - Verify Anti-Spyware policies are properly configured and signatures
+    up-to-date.
+  - Consider quarantining the affected host if multiple detections cluster
+    on the same source.
 where: |
-  (exists("log.spycat") || 
-   contains("log.message", "spyware") ||
-   contains("log.message", "Anti-Spyware") ||
-   contains("log.eventName", "Anti-Spyware") ||
-   contains("log.category", "Anti-Spyware") ||
-   (exists("log.spypri") && !equals("log.spypri", "0"))) &&
-  (equals("action", "blocked") || equals("log.fw_action", "drop"))
+  (
+    oneOf("log.eventCode", ["1157", "1158", "1159"]) ||
+    exists("log.spywareCategory") ||
+    contains("log.message", ["spyware", "Anti-Spyware"]) ||
+    contains("log.contentCategory", "Anti-Spyware")
+  ) && equals("actionResult", "denied")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:

rules/sonicwall/sonicwall_firewall/botnet_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,25 +14,30 @@ references:
   - https://www.sonicwall.com/support/knowledge-base/understanding-geo-ip-and-botnet-filter-diagnostics-options/200527122256150
   - https://attack.mitre.org/techniques/T1071/
 description: |
-  Detects potential botnet command and control (C2) communication or infected host behavior identified by SonicWall's botnet filter. This includes suspicious outbound connections, HTML infection chains, or known botnet signatures.
+  Detects potential botnet command and control (C2) communication identified
+  by the SonicWall Botnet Filter. Includes matches against SonicWall's Botnet
+  Filter signature codes and message text indicating known botnet endpoints.
 
   Next Steps:
-  1. Investigate the source IP for additional suspicious activity
-  2. Check network logs for other connections from the same host
-  3. Analyze DNS queries from the affected host
-  4. Review endpoint logs for signs of malware infection
-  5. Consider isolating the affected host if infection is confirmed
-  6. Update threat intelligence feeds and security signatures
-  7. Scan the host with updated antivirus/anti-malware tools
-where: (equals("log.category", "Botnet") || contains("log.message", "botnet") || contains("log.message", "infected") || contains("log.message", "C&C") || contains("log.message", "command and control") || equals("log.af_service", "botnet")) && (equals("action", "blocked") || equals("action", "dropped") || equals("log.fw_action", "drop"))
+  1. Investigate the source IP for other suspicious behavior (DNS, beaconing).
+  2. Check endpoint logs on the internal host for signs of infection.
+  3. Isolate the affected host if infection is confirmed.
+  4. Update threat intel feeds and blocklists with the observed C2 endpoint.
+where: |
+  (
+    oneOf("log.eventCode", ["1370", "1371"]) ||
+    equals("log.appFirewallService", "botnet") ||
+    contains("log.message", ["botnet", "Botnet", "infected", "C&C", "command and control"]) ||
+    contains("log.contentCategory", "Botnet")
+  ) && equals("actionResult", "denied")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:
       - field: origin.ip
         operator: filter_term
         value: '{{.origin.ip}}'
     within: 2h
-    count: 10
+    count: 5
 groupBy:
   - adversary.ip
   - target.ip

rules/sonicwall/sonicwall_firewall/capture_atp_verdicts.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,24 +14,37 @@ references:
   - https://www.sonicwall.com/support/knowledge-base/capture-atp-overview/170503785055490
   - https://attack.mitre.org/techniques/T1204/
 description: |
-  Detects when SonicWall Capture ATP (Advanced Threat Protection) identifies a file as malicious after sandbox analysis. This indicates an attempted malware delivery or execution that was blocked by the ATP service.
+  Detects when SonicWall Capture ATP (Advanced Threat Protection) sandboxes a
+  file and returns a malicious verdict. Indicates an attempted malware
+  delivery. Also covers RTDMI (Real-Time Deep Memory Inspection) verdicts
+  which share the ATP verdict pipeline on the firewall.
 
   Next Steps:
-  1. Investigate the source IP address for additional malicious activity
-  2. Review the file hash and name for threat intelligence correlation
-  3. Check if the same file was delivered to other internal systems
-  4. Verify ATP policies are properly configured and up to date
-  5. Consider blocking the source IP at the perimeter if confirmed malicious
-  6. Document the incident and update threat intelligence feeds
-where: (contains("log.msg", "Capture ATP") || contains("log.msg", "Gateway Anti-Virus") || contains("log.msg", "Sandbox") || equals("log.category", "Anti-Virus") || equals("log.af_type", "ATP")) && (contains("log.msg", "malicious") || contains("log.msg", "blocked") || contains("log.msg", "threat detected") || equals("log.result", "malicious") || equals("action", "blocked"))
+  1. Investigate the source IP for additional malicious activity.
+  2. Pivot on the file hash / URL captured in `log.note` against threat intel.
+  3. Check whether the same file reached other internal systems.
+  4. Verify ATP policies and enforce automated blocking if not already set.
+where: |
+  (
+    oneOf("log.eventCode", ["1440", "1441"]) ||
+    equals("log.appFirewallType", "ATP") ||
+    contains("log.message", ["Capture ATP", "Sandbox", "RTDMI"]) ||
+    contains("log.note", ["Capture ATP", "malicious verdict", "ATP verdict"])
+  ) &&
+  (
+    equals("log.threatResult", "malicious") ||
+    contains("log.message", ["malicious", "threat"]) ||
+    contains("log.note", ["malicious", "threat"]) ||
+    equals("actionResult", "denied")
+  )
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:
       - field: origin.ip
         operator: filter_term
         value: '{{.origin.ip}}'
     within: 1h
-    count: 2
+    count: 1
 groupBy:
   - adversary.host
   - adversary.ip

rules/sonicwall/sonicwall_firewall/gateway_antivirus_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,23 +14,22 @@ references:
   - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
   - https://attack.mitre.org/techniques/T1105/
 description: |
-  Detects when SonicWall Gateway Anti-Virus (GAV) identifies and blocks malicious content. This indicates potential malware attempting to enter the network through web traffic, email attachments, or file downloads. The Gateway Anti-Virus service scans HTTP, HTTPS, FTP, and SMTP traffic in real-time to detect and prevent malware from entering the network perimeter.
+  Detects when SonicWall Gateway Anti-Virus (GAV) identifies and blocks
+  malicious content in HTTP/HTTPS/FTP/SMTP traffic. Signals a malware delivery
+  attempt at the network perimeter.
 
   Next Steps:
-  1. Review the specific malware signature or threat name in the log details
-  2. Investigate the source IP address and geolocation for suspicious patterns
-  3. Check if the same source has attempted other malicious activities
-  4. Verify that the anti-virus definitions are up to date
-  5. Consider implementing additional network segmentation if internal hosts are affected
-  6. Review firewall policies to ensure proper traffic filtering
-  7. Escalate to incident response team if part of a coordinated attack campaign
+  1. Review the malware name/signature carried in `log.message` / `log.note`.
+  2. Investigate the source IP and geolocation for correlated attempts.
+  3. Confirm the AV definitions are current on the firewall.
+  4. Escalate to incident response if the activity is part of a broader
+     campaign against the tenant.
 where: |
-  (contains("log.gcat", "Gateway Anti-Virus") || 
-   contains("log.message", "virus") || 
-   contains("log.message", "malware") ||
-   contains("log.eventName", "Anti-Virus") ||
-   contains("log.category", "Anti-Virus")) &&
-  equals("action", "blocked")
+  (
+    oneOf("log.eventCode", ["79", "608", "609", "1122"]) ||
+    (equals("log.groupCategory", "Security Services") && contains("log.message", ["virus", "malware", "Anti-Virus"])) ||
+    contains("log.contentCategory", "Anti-Virus")
+  ) && equals("actionResult", "denied")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:

rules/sonicwall/sonicwall_firewall/intrusion_prevention_alert.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,23 +14,27 @@ references:
   - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
   - https://attack.mitre.org/techniques/T1190/
 description: |
-  Detects when SonicWall IPS identifies and blocks intrusion attempts, including buffer overflows, SQL injection, cross-site scripting, and other network-based attacks targeting vulnerabilities. This rule triggers when the SonicWall firewall's Intrusion Prevention System detects malicious traffic patterns or known attack signatures.
+  Detects when SonicWall Intrusion Prevention System (IPS) blocks an attack
+  matching a known signature — buffer overflow attempts, SQL injection,
+  cross-site scripting, exploit kits, etc. Reflects the IPS Prevention Alert
+  message family (event codes 88 / 89 / 100 / 785) as well as the descriptive
+  `log.message`, `log.contentCategory` and `log.ipsCategory` fields.
 
   Next Steps:
-  1. Verify the blocked attack by reviewing the SonicWall logs for attack details and signatures matched
-  2. Check if the attack was successfully blocked or if any traffic bypassed the IPS
-  3. Investigate the source IP for additional malicious activity or patterns
-  4. Review target systems for any signs of compromise if the attack was not fully blocked
-  5. Update IPS signatures if new attack patterns are discovered
-  6. Consider implementing additional network segmentation if attacks are targeting critical systems
-  7. Review and update security policies if necessary to prevent similar attacks
+  1. Review the matched signature and CVE (if any) in `log.message` / `log.note`.
+  2. Confirm the block succeeded — check for follow-up connections from the
+     same source that bypassed IPS.
+  3. Investigate the target for compromise signs if the signature was severity
+     high/critical.
+  4. Update IPS profile if the target service is not supposed to expose that
+     surface.
 where: |
-  (exists("log.ipscat") || 
-   contains("log.message", "IPS") ||
-   contains("log.eventName", "Intrusion") ||
-   contains("log.category", "Intrusion Prevention") ||
-   (exists("log.ipspri") && !equals("log.ipspri", "0"))) &&
-  (equals("action", "blocked") || equals("log.fw_action", "drop"))
+  (
+    oneOf("log.eventCode", ["88", "89", "100", "785"]) ||
+    exists("log.ipsCategory") ||
+    contains("log.message", ["IPS Detection Alert", "IPS Prevention Alert", "Intrusion"]) ||
+    contains("log.contentCategory", "Intrusion Prevention")
+  ) && equals("actionResult", "denied")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:

rules/sonicwall/sonicwall_firewall/sonicwall_admin_auth_failures.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,29 +14,32 @@ references:
   - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
   - https://attack.mitre.org/techniques/T1110/
 description: |
-  Detects multiple failed authentication attempts to the SonicWall management interface, indicating potential brute force attacks against administrative credentials.
+  Detects failed authentication attempts against the SonicWall management
+  interface (GUI/CLI/API). Repeated failures from a single source IP suggest
+  a brute-force or credential-stuffing attack targeting admin credentials.
 
   Next Steps:
-  1. Investigate the source IP address attempting authentication
-  2. Check if the source IP is from an authorized management network
-  3. Review for successful logins from the same IP after failures
-  4. Consider blocking the source IP on the management interface
-  5. Restrict management access to specific IP addresses
-  6. Enable account lockout and two-factor authentication
+  1. Investigate the source IP — geolocation, reputation, previous activity.
+  2. Confirm the source is NOT from an authorized management network.
+  3. Search for a successful admin login from the same IP AFTER the failures
+     (indicator of a successful brute force).
+  4. Restrict management access to specific IP ranges and enforce MFA.
 where: |
-  ((contains("log.message", ["admin", "management", "login"]) &&
-    contains("log.message", ["fail", "denied", "invalid", "incorrect"])) ||
-   contains("log.eventName", ["Administrator login failed", "Login failure"]) ||
-   contains("log.category", "Authentication Access")) &&
-  exists("origin.ip")
+  (
+    oneOf("log.eventCode", ["29", "32", "33", "1246"]) ||
+    (
+      contains("log.message", ["admin", "administrator", "login", "management"]) &&
+      contains("log.message", ["failed", "fail", "denied", "invalid", "incorrect"])
+    )
+  ) && exists("origin.ip")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:
       - field: origin.ip
         operator: filter_term
         value: '{{.origin.ip}}'
     within: 15m
-    count: 10
+    count: 5
 groupBy:
   - adversary.ip
   - adversary.user