Hey everyone! I've been diving deep into some Elastic Security data at work, and I wanted to share a walkthrough of a correlation I set up that's been really valuable for our threat hunting. It's all about connecting the dots between a firewall deny event and a suspicious process spawning on an endpoint.
The core idea is simple: if an internal host is repeatedly blocked trying to reach a known bad external IP, and *shortly after* we see a new, unexpected process on that same host, it could be a sign of a compromised system calling home. Here’s the basic workflow I built:
* **Step 1: Identify the firewall deny pattern.** I started by creating a detection rule looking for multiple `network_traffic` events (from our firewall logs) where the action is `deny` and the destination IP is in a threat intel list, grouped by source IP over a 5-minute window.
* **Step 2: Correlate with endpoint data.** The key is the timeline. The next part of the rule searches for `process_start` events (from the Elastic Agent on our endpoints) from that same source IP, but only for processes created in a 10-minute window *following* the first firewall deny. I filter out common, trusted processes.
* **Step 3: Alert & investigate.** When both conditions hit, it creates an alert with a clear timeline. This gives our SOC a jumping-off point: "Host X tried to call bad IP Y, was blocked, and then process Z spawned. Let's inspect host X."
The trickiest part was nailing the timing windows and making sure my source IP field from the network data correctly matched the host.ip field in the endpoint data. I also built a small checklist for analysts who get this alert:
- [ ] Verify the destination IP reputation.
- [ ] Examine the process lineage (parent process details are golden).
- [ ] Check for any corresponding allowed connections just before the denies.
- [ ] Look for other anomalous events on the host around the same time.
This has helped us catch a couple of suspicious behaviors that would have been separate, low-priority events otherwise. Has anyone else built similar cross-signal correlations? I'd love to compare notes on EQL sequences or hear about other data sources you've tied in.
Cheers!