27 lines
779 B
Python
27 lines
779 B
Python
from __future__ import annotations
|
|
|
|
from .logs import THREAT_ACTIONS
|
|
from .models import LogEvent
|
|
from .normalization import canonical_value
|
|
|
|
|
|
DETECTOR_MINIMUMS = {
|
|
"auth_failure": 5,
|
|
"dns_query": 20,
|
|
"deny_action": 10,
|
|
}
|
|
|
|
|
|
def event_detector_categories(event: LogEvent) -> tuple[str, ...]:
|
|
fields = event.fields
|
|
action = event.action
|
|
event_id = canonical_value(fields, "eventid")
|
|
categories: list[str] = []
|
|
if action in {"fail", "failed", "failure", "login_failed", "logon_failed", "authentication_failed"} or event_id == "4625":
|
|
categories.append("auth_failure")
|
|
if fields.get("dns_query"):
|
|
categories.append("dns_query")
|
|
if action in THREAT_ACTIONS:
|
|
categories.append("deny_action")
|
|
return tuple(categories)
|