The following content pack is available for use with a Graylog Illuminate license and Graylog Enterprise or Graylog Security. Contact sales to learn more about obtaining Illuminate.
Warning: This article contains a list of legacy anomaly detectors included in versions of Illuminate prior to 5.2 for use with the Graylog anomaly detection tool. A current list of supported anomaly detectors may be found in the Illuminate documentation.
For a complete index of all the common message fields populated in each event log message generated by anomaly detection, see the corresponding guide.
Updated Rules Matrix
The following list details which legacy anomaly detectors are now supported by updated anomaly detectors released with Illuminate 5.2. For details on how to enable new anomaly detectors for installations currently utilizing legacy anomaly detectors, see the documentation on Illuminate anomaly detection.
| Legacy Anomaly Detection Rule | Updated Anomaly Detection Rule |
|---|---|
| Cisco ASA - Unusual Data Transfer | Cisco ASA - Unusual Data Transfer V2 |
| Fortigate - Unusual Data Transfer | Fortigate - Unusual Data Transfer V2 |
| Linux Auditbeat - Failed Authentication | Linux Auditbeat - Failed Authentication V2 |
| Linux Auditbeat - File Deletion | Linux Auditbeat - File Deletion V2 |
| Office 365 - Failed Authentication | Office 365 - Authentication Activity V2 |
| Okta - Failed Authentication | Okta - Failed Authentication V2 |
| Palo Alto - Data Exfiltration | Palo Alto - Data Exfiltration V2 |
| Palo Alto - Failed Authentication | Palo Alto - Failed Authentication V2 |
| Bluecoat Web Proxy - Data Exfiltration | Symantec ProxySG - Data Exfiltration V2 |
| Windows Security Event Log - Failed Authentication | Windows Security Event Log - Failed Authentication v2 |
| Windows Security Event Log - File Permissions Change | Windows Security Event Log - Object Permissions Change V2 |
| Windows Security Event Log - File Enumeration | Windows Security Event Log - User File Activity |
| Windows Security Event Log - File Write | Windows Security Event Log - User File Activity |
| Windows Security Event Log - File Deletion | Windows Security Event Log - User File Activity |
Detector Index
The following is a list of legacy anomaly detectors included in versions of Illuminate prior to 5.2. This list is included as a reference only. We strongly recommend you upgrade to the currently supported anomaly detection rules for use with Illuminate 5.2+.
| Detector Name | Description | Indices | Requires | Anomaly-Specific Fields |
|---|---|---|---|---|
| Palo Alto - Data Exfiltration | This detection monitors Palo Alto logs for any unusual data transfers between hosts. Anomaly analysis is performed per host; events are aggregated by the fields source_ip and destination_ip. |
Palo Alto Logs (Index Prefix: gl_paloalto*) | Palo Alto devices running 9.1.x or greater sending logs to the Graylog Server. Illuminate 2.2.2 with the Palo Alto processing pack and the Anomaly Detection add-on pack enabled. | Monitored fields: source_bytes_sent Added fields: anomaly_total_source_bytes_sent |
| Fortigate - Unusual Data Transfer | This detection monitors the amount of traffic associated with Fortinet Fortigate firewalls. Anomaly analysis is performed per host; events are aggregated by the field source_ip. |
Fortinet Event Log Messages (Index Prefix: gl_forti*) | Fortinet Fortigate configured and sending logs to the Graylog Server. Illuminate 2.2.2 or greater installed with the Fortinet Fortigate technology pack and the Anomaly Detection add-on pack enabled. | Monitored fields: network_bytes Added fields: anomaly_total_network_bytes |
| Windows Security Event Log - File Deletion | This detection monitors for changes to file deletions in your environment’s Windows hosts by monitoring Windows Event ID 4663. Events are aggregated by the field user_name. |
Windows Event Log Messages (prefix: gl_windows*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows systems configured to audit file deletion activity. | Categorical Fields: file_delete_count |
| Linux Auditbeat - Unusual Data Transfer | This detection monitors the amount of traffic associated with Linux hosts. Anomaly analysis is performed per host; events are aggregated by the field host_hostname. |
Linux Auditbeat Logs (Index Prefix: gl_linux_auditbeat*) | Linux Auditbeat configured with the System module (not part of Beats OSS) and Sockets Dataset enabled and sending logs to the Graylog Server Beats input(s). Illuminate 2.2.2 or greater with the Linux Auditbeat technology pack and the Anomaly Detection add-on pack enabled. | Monitored fields: network_bytes Added fields: anomaly_total_network_bytes |
| Palo Alto - Failed Authentication | This detection monitors the amount of authentication activity for failed logon attempts associated with Palo Alto GlobalProtect clients. Anomaly analysis is performed per user; events are aggregated by the field user_name. |
Palo Alto Logs (Index Prefix: gl_paloalto*) | Palo Alto devices running 9.1.x or greater sending logs to the Graylog Server. Illuminate 2.2.2 with the Palo Alto processing pack and the Anomaly Detection add-on pack enabled. | Monitored fields: anomdet_paloalto_logon_failed Added fields: total_logon_failure_count |
| Windows Security Event Log - Failed Authentication | This detection monitors failed authentication for Windows systems. This can include Windows Security Event ID 4625, Event ID 4771, or Event ID 4776 (Failure). Events are aggregated by the field user_name. |
Windows Security Event Log Messages (prefix: gl_windows_security*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows systems configured to audit logon and authentication activity. | Categorical Fields: anomaly_total_windows_authentication_failures |
| Office 365 - Failed Authentication | This detection monitors failed authentication for Windows systems. This can include Windows Security Event ID 4625, Event ID 4771, or Event ID 4776 (Failure). Events are aggregated by the field user_name. |
Windows Security Event Log Messages (prefix: gl_windows_security*) | O365 service sending logs to the Graylog Server. Illuminate 2.2.2 with the O365 processing pack and the Anomaly Detection add-on pack enabled | Monitored Fields: anomdet_windows_auth_failure Categorical Fields: total_windows_authentication_failures |
| Windows Security Event Log - File Permissions Change | This detection monitors for changes to file permissions in your environment’s Windows hosts by monitoring Windows Event ID 4670. Events are aggregated by the field user_name. |
Windows Event Log Messages (prefix: gl_windows*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows systems configured to audit logon and authentication activity. | Added Fields: anomaly_file_perm_change_count |
| Linux Auditbeat - File Deletion | Linux Auditbeat - File DeletionThis detection monitors for changes to file deletions associated with Linux hosts. Anomaly analysis is performed per host; events are aggregated by the field host_reference. |
Linux Auditbeat Logs (Index Prefix: gl_linux_auditbeat*) | Linux Auditbeat configured with the System module (not part of Beats OSS) and Sockets Dataset enabled and sending logs to the Graylog Server. Illuminate 2.2.2 or greater with the Linux Auditbeat technology pack and the Anomaly Detection add-on pack enabled. | Added fields: anomaly_total_linux_auditbeat_logon_failed |
| Windows Security Event Log - File Write | This detection monitors for changes to file-write events in your environment’s Windows hosts by monitoring Windows Event ID 4663. Events are aggregated by the field user_name. |
Windows Event Log Messages (prefix: gl_windows*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows systems configured to audit file write activity. | Categorical Fields: anomaly_file_write_count |
| Linux Auditbeat - Failed Authentication | This detection monitors the amount of authentication activity for failed logon attempts associated with Linux hosts. Anomaly analysis is performed per host; events are aggregated by the field user_name. |
Linux Auditbeat Logs (Index Prefix: gl_linux_auditbeat*) | Linux Auditbeat configured with the System module (not part of Beats OSS) and Sockets Dataset enabled and sending logs to the Graylog Server. Illuminate 2.2.2 or greater with the Linux Auditbeat technology pack and the Anomaly Detection add-on pack enabled. | Added fields: anomaly_files_deleted_count |
| Okta - Failed Authentication | This detection monitors the amount of authentication activity for failed logon attempts associated with Okta clients. Anomaly analysis is performed per user; events are aggregated by the field user_name. |
Okta Logs (Index Prefix: gl_okta*) | Okta service sending logs to the Graylog Server. Illuminate 2.2.2 with the Okta processing pack and the Anomaly Detection add-on pack enabled. | Added fields: anomaly_total_okta_logon_failed |
| Bluecoat Web Proxy - Data Exfiltration | This detection monitors Bluecoat ProxySG logs for any unusual data transfers between hosts. Anomaly analysis is performed per user; events are aggregated by the fields user_name and destination_ip. |
Symantec Event Log Messages (Index Prefix: gl_symantec*) | Bluecoat ProxySG sending logs to the Graylog Server. Illuminate 2.2.2 with the Symantec ProxySG technology pack and the Anomaly Detection add-on pack enabled. | Monitored fields: source_bytes_sent Added fields: anomaly_total_source_bytes_sent |
| Cisco ASA - Unusual Data Transfer | This detection monitors the amount of traffic reported by Cisco ASA devices. Anomaly analysis is performed per network connection; events are aggregated by the fields source_reference and destination_reference. |
Cisco Devices Event Log Messages (Index Prefix: gl_cisco*) | Cisco ASA devices configured and enabled and sending logs to the Graylog Server. Illuminate 2.2.2 or greater with the Cisco ASA technology pack and the Anomaly Detection add-on pack enabled. | Monitored fields: network_bytes Added fields: total_network_bytes |
| Windows Security Event Log - File Enumeration | This detection monitors for read events to files in your environment’s Windows hosts by monitoring Windows Event ID 4663. Events are aggregated by the fields user_name and process_name. |
Windows Event Log Messages (prefix: gl_windows*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows system(s) configured to audit file deletion activity. | Categorical Fields: anomaly_file_read_count |
