Security Jiujitsu

Analysis Technique – StaEsEcal – Part One
This technique requires some experimentaEon, and threat
modeling. You need to know your environment, to know
what you want to learn about.
Establish your base dataset:
tag=ids tag=auack
| bucket _Eme span=1d | stats count by severity signature dest
_Eme
| stats sum(count) as count avg(count) as avg stdev(count) as
stdev sum(eval(if(_Eme > relaEve_Eme(now(), “-­‐1d”), count,
0))) as recent_count min(_Eme) as earliest by severity signature
dest
| eventstats avg(avg) as avg_num_per_dest avg(earliest) as
avg_earliest sum(count) as sig_wide_count sum(recent_count)
as sig_wide_recent_count by signature
Pull IDS Data
Check Daily DesEnaEons
per Signature
Pull relevant metrics per
signature, per host
Pull relevant metrics per
signature overall
43