Reference no: EM133214297

Need Suggestions to Improve or make any Changes to the IBM Q Radar Rules with detailed  explanations:

Please do not mix all the rules. Need Separate explanation for each of All:

Rule 1: Apply UBA : SMTP Large File Size on events which are detected by the Local system and when the event QID is one of the following (2000226) CORP-ITP_FileSize_SMTP-M01 and when an event matches any of the following BB:UBA : Common Event Filters

Rule 2: Apply UBA : ReEncrypt Policies because something went through and was re-encrypted on events which are detected by the Local system and when an event matches any of the following BB:UBA : Common Event Filters and when the event QID is one of the following (2000222) PKW-ReEncrypt_SMTP-M0

Rule 3: Apply Possible Adobe Vulnerability Exploit CVE-2022-24086 on events which are detected by the Local system and when the event(s) were detected by one or more of F5 Networks BIG-IP ASM and when the event matches Request Method (custom) is any of POST, URL Query String (custom) contains all of {{ .... }}

Rule 4: pply UBA : Suspicious Access Followed by Data Exfiltration on events which are detected by the Local system and when an event matches any of the following BB:UBA : Common Event Filters and when BB:UBA : Data Exfiltration match at least 1 times in 1 hour(s) after any of UBA : User Access from Unusual Locations, UBA : User Access from Prohibited Location, UBA : User Access from Restricted Location match with the same Username

Rule 5: Apply UBA : Initial Access Followed by Suspicious Activity on events which are detected by the Local system and when an event matches any of the following BB:UBA : Common Event Filters and when BB:UBA : Compromised Account - Execution match at least 1 times with the same Username in 24 hour(s) after BB:UBA : Compromised Account - Initial Access match

Rule 6: Apply UBA : Potentially Compromised Account on events which are detected by the Local system and when UBA : Suspicious Activity Followed by Exfiltration match at least 1 times with the same Username in 24 hour(s) after UBA : Initial Access Followed by Suspicious Activity match.

Rule 7:  pply Suspicious Get Information for AD Groups or DoesNotRequirePreAuth User on events which are detected by the Local system and when the event(s) were detected by one or more of Microsoft Windows Security Event Log and when the event matches UTF8(payload) ILIKE 'get-ADPrincipalGroupMembership' OR (UTF8(payload) ILIKE 'get-aduser' AND UTF8(payload) ILIKE '-f' AND UTF8(payload) ILIKE '-pr' AND UTF8(payload) ILIKE 'DoesNotRequirePreAuth') AQL filter query