Create a rule to check malicious traffic

[ravpatil]

I have an active channel which populates a list of malicious IP's and it keeps updating itself.

My requirement is to have a rule populated everytime an internal IP interacts with one of the IP's in the list.

Wanted to know how do I do it.

My thoughts are:

Have the list of the IP's from the active channel populated to an Dynamic active list

Have a rule to check the network traffic with the list present in the active list.

Will this work?

Or would there be an easier way of achieving this.

Thanks,

Ravi.

[reswob4]

You could do with with an active list or a session list.  I'm using active lists to check for activity to undesirable IPs and domains. 

[cbroncano]

Hi Craig,

Where do you get your list from?

[reswob4 · Accepted solution]

In our case, our is a bit more static than what Ravinder is doing.  We receive a csv list from an internal org and I upload it into an active list on a regular basis.

However, there are several methods to create and maintain a list of bad IPs/Domains. 

1. Subscribe to a Threat Intel Feed (an excellent free one is https://intel.criticalstack.com/. Even though it's built for a different product, the results can be parsed into a csv and sent to ArcSight where a rule can put the IPs and Domains into active lists. For a different system, I'm using a simple python script to parse the results into a format I can use.)

2.  Roll your own script to download from publicly available lists (i.e. Suspicious Domains - SANS Internet Storm Center). Then parse and send to ArcSight where a rule can put the IPs and Domains into different active lists.

3. Manually create/maintain lists.

Hope that helps.

[ravpatil]

Hello Craig,

Thanks for the reply.

My concern here is I do not have an Active List and the only source is the Active Channel which contains the IP's.

How do I pull the IP's from the channel to the Active List ?

[rkent1]

Hi , you can make a rule that looks for the events (the ones you are looking at in your active channel) and use a rule action to populate a list.

Can you clarify what type of active channel it is? What sort of events are they? A screenshot would certainly help here.

[ravpatil]

Thanks Richard.

That seems to be the right approach. The active channel is not currently receiving events and is scheduled to receive events after few hours. That was the reason there was no result populated on the active list that I had created.

Hope that'll work. Will wait for the next batch of events appear in the channel.

Fingers Crossed.