Deploy Custom Rules

If the custom rules that you are deploying are customer specific please follow this guide. If not, please refer to this guide instead. Deploying rules that are generic to all customers

If you have yet to create or export and test your custom rules please refer to Exporting custom rules and deploying via code and return here once you are done.

Setting up the environment

Before deploying our custom rules, we will first have to ensure that your environment is up to date. To do this please refer to XDR provisioning resources

Add custom rules

Clone the following repos: - git clone https://github.com/quantum-sec/infrastructure-live.git <- Replace URL with customer specific repository.

git clone https://github.com/quantum-sec/infrastructure-modules <- Replace URL with customer specific repository. > Note > > Steps 7 and 8 are only applicable if you are modifying an existing rule to meet the needs of the customer. If using a completely new custom rule, proceed to step 9.

Ensure you have all prerequisites installed. They are located here 1. Open the Terminal application

Switch to the home directory by using the command cd ~
Create a “Customers” directory locally that you will use to store customer based repositories using the command mkdir. Example: mkdir Customers
Change into the “Customers” directory using cd Customers Make an additional directory for the customer you are creating custom rules for. Example: mkdir (Customer Name Here)
Change into the customer directory. Example: cd (Customer Name Here)
Clone both the Infrastructure-live and infrastructure-modules repositories that are specific to the customer.
If you are tuning an existing rule, Look for the original YAML Rule File for the rule that you are looking to tune from the customer infrastructure-modules repository that was locally created in step 3. Path should look like infrastructure-modules/azure/content/rules/
If you are tuning an existing rule, Modify the query within the YAML file to match what you are looking to tune.
In your Terminal, change your directory to infrastructure-live/azure/prod/southeastasia/<prefix>-log-analytics/services/sentinel-rules
Create a custom-rules directory within the sentinel-rules directory.
Place all custom YAML rules into the custom-rules/ directory.
Open config.hcl found in your customer’s sentinel-rules directory (Example path: https://github.com/quantum-sec/infrastructure-live/blob/master/azure/prod/southeastasia/quantum-log-analytics/services/sentinel-rules/config.hcl and look for the custom_rules field: # Add a list of individual rules that should be deployed to the Sentinel instance from custom-rules/. # To use terraform to manage the deployment of a custom rule, add the yaml files to the custom-rules directory. # Rules are referenced from the relative path of custom-rules/ so do not include the custom-rules/ prefix in a rule. # # custom_rules = [ # "suspicious-powershell-zipping-activity", # ] Add the custom rules: # Add a list of individual rules that should be deployed to the Sentinel instance from custom-rules/. # To use terraform to manage the deployment of a custom rule, add the yaml files to the custom-rules directory. # Rules are referenced from the relative path of custom-rules/ so do not include the custom-rules/ prefix in a rule. # custom_rules = [ "my-new-custom-rule", "conti-malware-detections-via-commandline-arguments" # "suspicious-powershell-zipping-activity", # ]

Note

If changing a production rule to a custom rule you will need to also exclude the original rule so it’s not deployed in addition to the custom rule, add to the exclude rules section the rule you modified.

  # exclude_rules = [
  #   "ioc/application/powershell/suspicious-powershell-zipping-activity",
  # ]

  exclude_rules = [
    "sentinel-rules/platform/azure/activedirectory/azureportalsigninfromanotherazuretenant",
    "ioc/security/sysmon/conti-malware-detections-via-commandline-arguments"
  ]

Example

Note

You do not need to add the custom-rules/ prefix or the yaml file extension to this array.

Deploying the change

Log into the service account using az login and using your customer specific credentials To deploy the custom rules, run the update environment script.

Commit changes

Once you have verified that everything is working as intended please commit the changes and push it to source control.

Potential Errors and Solutions

This section covers some of the potential errors that you may face and how to resolve them.

Backend initialization required, please run “terraform init

Please check if you are logged into the correct Azure account with the correct subscription set.

If the errors still persist, run az logout and sign in by following Logging into Azure and setting subscription

Module source has changed

Run the following command

terragrunt init

Debug Terragrunt

If the error you are facing is not one of the above, you can execute the following command to enable debugging. terragrunt plan --terragrunt-log-level debug --terragrunt-debug