Reference no: EM133214217

Need Suggestions to Improve or make any Changes to the IBM Q Radar Rules with detailed  explanations:

Please do not mix all the rules. Need Separate explanation for each of all.

Rule 1: Apply UBA : Data Exfiltration by Cloud Services on events which are detected by the Local system
and when an event matches all of the following BB:UBA : Common Event Filters, BB:UBA : File Transfer to Cloud services

Rule 2: Apply UBA : Large Outbound Transfer by High Risk User on events which are detected by the Local system
and when an event matches all of the following BB:UBA : Common Event Filters
and when any of Username are contained in any of UBA : High Risk Users - AlphaNumeric (Ignore Case)
and when the event matches Bytes Sent (custom) is greater than or equal to 200,000

Rule 3: Apply UBA : User Geography Change on events which are detected by the Local system
and when an event matches all of the following BB:UBA : Common Event Filters, BB:UBA : Excluded Geographic Locations, Incoming Traffic to High Risk Countries
and when any of Username are contained in any of UBA : User Geography Change - AlphaNumeric (Ignore Case)
and NOT when any of Username is the key and any of Source Geographic Country/Region is the value in any of UBA : Users Last Country - AlphaNumeric (Ignore Case)

Rule 4: Apply UBA : User Access from Multiple Locations on events which are detected by the Local system
and when an event matches all of the following BB:UBA : Common Event Filters, BB:UBA : Excluded Geographic Locations
and when at least 2 events are seen with the same Username and different Source Geographic Country/Region in 15 minutes

Rule 5: Apply UBA : User Access from Unusual Locations on events which are detected by the Local system
and when an event matches all of the following BB:UBA : Common Event Filters, BB:UBA : Excluded Geographic Locations, BB:UBA : Unusual Source Locations

Rule 6: Apply UBA : Detect IOCs For Locky on events which are detected by the Local system
and when an event matches any of the following BB:UBA : Common Log Source Filters
and when an event matches any of the following BB:UBA : Detect Locky Using IP, BB:UBA : Detect Locky Using URL

Rule 7: Apply UBA : Detect IOCs for WannaCry on events which are detected by the Local system
and when an event matches any of the following BB:UBA : Common Log Source Filters
and when an event matches any of the following BB:UBA : Detect WannaCry Using Hashes, BB:UBA : Detect WannaCry Using IP, BB:UBA : Detect WannaCry Using URL