Customization Rules FAQ

Find answers to common questions about custom detection rules and detection suppression rules.

Custom detection rules FAQ

Can I use logical data types, such as domain and IP address, in detection rules?

Yes. For details, see Logical types.

Are all schema fields available for custom detections?

Most event fields are available, with some exceptions. For details, see Available schema fields.

Are custom rules limited in how many detections they can create?

Custom rules are limited to creating a maximum of 5,000 detections an hour or 100,000 in 24 hours. If that limit is exceeded, the circuit breaker turns off the rule and we email the rule author to inform them the rule exceeded the limits. If this happens, update the rule to decrease the number of detections.

What are the regex limitations of Custom Rules?

For details, see Regex limitations.

Detection suppression rules FAQ

What regular expression features do suppression rules support?

The detection suppression engine utilizes Hyperscan to apply regular expressions. Hyperscan supports the pattern syntax used by the PCRE library libpcre, described at http://www.pcre.org/. However, not all constructs available in libpcre are supported. The use of unsupported constructs will result in compilation errors.

For more details, see Hyperscan Developer Reference Compilation.

For domain names or IP addresses, do I need to do anything special to handle the dots?

Yes, you need to escape the dots using a backslash. In regular expressions, a dot means to match any single character except newline.

Example

192\.168\.1\.1 or www\.sophos\.com

What entities can I match against?

When building your rule from a specific detection, you can pick which entities from the detection to use to create the rule. The following entities can be used to create detection suppression rules. Unique entities are parsed from the individual events included in the detection.

Entity Prefix	Entity Description
authDomainName	Active Directory Domain
sourceUserName	Auth Source Username
sourceAuthDomainName	Auth Source Domain Name
targetUserName	Auth Target Username
targetAuthDomainName	Auth Target Domain Name
computerName	Computer Name
decodedScriptSha1	Decoded Script SHA1
destHostName	Destination Hostname
destIpAddress	Destination IP Address
destIpGeo	Destination IP Geolocation
destMacAddress	Destination MAC Address
dnsName	DNS Name
fileMd5	File MD5
fileName	File Name
fileSha1	File SHA1
fileSha256	File SHA256
fileSha512	File SHA512
ipAddress	IP Address
city	IP Address Geolocation City
country	IP Address Geolocation Country
latLon	IP Address Latitude,Longitude
macAddress	MAC Address
programMd5	Program MD5
programName	Program Name
programSha1	Program SHA1
programSha256	Program SHA256
programSha512	Program SHA512
registryName	Registry Name
registryPath	Registry Path
scriptSha1	Script SHA1
sensorHostId	Sensor Host ID
sensorId	Sensor ID
sourceIpAddress	Source IP Address
sourceIpGeo	Source IP Geolocation
sourceMacAddress	Source MAC Address
topPrivateIpDomain	Top Private IP Domain
userName	Username
workstationName	Workstation Name

Which detectors support detection suppression?

All detectors and detection sources support suppression.

Are there limitations to using query language for suppression rules?

There are some limitations. For details, see Limitations to using query language for suppression rules.

How can I create a suppression rule for detections containing a specific commandline?

To suppress by commandline, use the process.commandline schema in the Advanced Search query for the suppression rule.

FROM detection WHERE process.commandline CONTAINS 'your_string'

How can I use detection entities in my suppression rules?

There are two ways to use the detection entities:

Use logical types in the query to include the desired detection entity. For details, see Logical types.
Example

To suppress by hostname, use @host:
```
FROM detection WHERE @host='somehostname'
```
Use the entities field directly; when viewing a detection you want to suppress, in the JSON view, open entities.entities. Use the entire string to match against the desired entity.
Example

To suppress by destination IP address:
```
FROM detection WHERE entities='destIpAddress:128.206.10.3'
```

How can I use IP CIDR ranges for suppression?

You can use IPv4 CIDR ranges in your rule's query. For more details on CIDR notation, see CIDR Notation.

Note

Detection search does not support CIDR ranges, so these queries cannot be built using Advanced Search. We recommend that you build the query in Advanced Search without the CIDR ranges and then add the ranges when ready to create the suppression rule.

Note

IPv6 CIDR ranges are not supported in suppression rules at this time.

How do I suppress detections with IPv6 addresses?

Suppression rules support IPv6 addresses. When you use an IPv6 address in a suppression rule, the rule automatically normalizes the address so that it matches equivalent representations. For example, a rule that uses the compressed form also matches the uncompressed form, and vice versa.

You can match an IPv6 address in a suppression rule in three ways:

Logical type, such as @ip:

FROM detection WHERE @ip = '2001:db8:85a3::8a2e:370:7334'

Schema field, such as auth.source_address:

FROM detection WHERE auth.source_address = '2001:db8:abcd:1234:0:1::'

Entities, such as sourceIpAddress:

FROM detection WHERE entities = 'sourceIpAddress:2001:db8:abcd:1234:0:1::'

In all three cases, the rule matches events whether the address was stored in compressed (2001:db8:abcd:1234:0:1::), partially expanded (2001:db8:abcd:1234:0:1:0:0), or fully expanded (2001:db8:abcd:1234:0000:0001:0000:0000) format.

Note

Suppression rules do not support IPv4-mapped IPv6 addresses such as ::ffff:192.0.2.47 at this time.
Suppression rules do not support IPv6 CIDR ranges at this time. To suppress a range of IPv6 addresses, create individual rules or use a regular expression pattern.