Detection Rule Usefulness Evaluation Based On DOVE Model

Query

AlertInfo
| join kind=inner AlertEvidence on AlertId
| extend DateHour=bin(Timestamp,1h)
| summarize Group_Alert_Tittles=make_set(Title),Different_Detection_Sources=make_set(DetectionSource),Number_Detection_Sources=dcount(DetectionSource) by DateHour,AccountUpn,EmailSubject,FileName, DeviceName, RemoteIP, RemoteUrl, Application
| where Number_Detection_Sources > 1 and Different_Detection_Sources contains "Custom detection" and (isnotempty(AccountUpn) or isnotempty(RemoteIP) or isnotempty(EmailSubject) or isnotempty(DeviceName) or isnotempty(RemoteUrl) or isnotempty(Application))
| order by Number_Detection_Sources desc

About this query

Explanation

This KQL query is designed to evaluate the effectiveness of detection rules in a security monitoring system by identifying potential overlaps in alerts. Here's a simplified explanation of what the query does:

Data Source: The query pulls data from two tables, AlertInfo and AlertEvidence, and joins them based on a common field, AlertId.
Time Binning: It groups the data into hourly segments using the Timestamp field, creating a new field called DateHour.
Summarization: For each hour, it collects and summarizes information about alerts, including:
- The titles of the alerts (Group_Alert_Tittles).
- The sources of the detections (Different_Detection_Sources).
- The number of different detection sources (Number_Detection_Sources).
Filtering: The query filters the results to find cases where:
- There is more than one detection source (Number_Detection_Sources > 1).
- At least one of the detection sources is a "Custom detection".
- There is relevant information in fields like AccountUpn, RemoteIP, EmailSubject, DeviceName, RemoteUrl, or Application.
Ordering: The results are ordered by the number of detection sources in descending order, highlighting cases with the most overlap.

The goal of this query is to identify alerts that might be redundant or overlapping, particularly those involving custom detection rules. By doing so, it helps in assessing the usefulness of current detection rules and reducing noise in incident analysis. This is part of a broader evaluation model called the DOVE Model, which aims to improve detection efficiency by considering factors like detection type, system coverage, threat recency, and source/provider.

KQL Search