What's included
Twelve detections, for both SIEMs.
Each runs in your SIEM, as a Sentinel rule or hunting query and a Splunk search. They read the events Altiward or altiward-forwarder sends; the forwarder sends grants and revocations only, so most need Altiward.
| Detection | Sentinel | Splunk | Needs events from |
|---|---|---|---|
| Admin rights SAP Privileges didn't grant, still unexplained | Analytics rule | Alert | Altiward |
| Admin rights that outlived their expiry | Analytics rule | Alert | Altiward |
| A tamper check failing on a Mac | Analytics rule | Alert | Altiward |
| Persistence that appeared while someone was admin | Analytics rule | Alert | Altiward |
| A local account that appeared while someone was admin | Analytics rule | Alert | Altiward |
| A Mac that stopped checking in | Analytics rule | Alert | Altiward |
| A grant or revocation the Mac's admin group contradicts | Analytics rule | Alert | Altiward |
| The console's break-glass token used | Analytics rule | Alert | Altiward |
| More than 10 elevations by one person in 7 days | Analytics rule | Alert | Altiward or the forwarder |
| Elevations, with the reason, expiry and what reported them | Hunting query | Report | Altiward or the forwarder |
| Console actions: revocations, enrollment approvals, settings changes | Hunting query | Report | Altiward |
| Console sign-ins and sign-outs | Hunting query | Report | Altiward |
Install
Into the SIEM you already run.
- Microsoft Sentinel
- Deploy every analytics rule at once with the Deploy to Azure template (preview), or create one from its YAML. Paste a hunting query into Logs. The rules read the
AltiwardOCSF_CLtable, which Altiward's setup script creates; altiward-forwarder uses the same table. - Splunk
- Copy
savedsearches.confinto one of your apps. The alerts and reports start switched off: enable the ones you want and add an alert action. Each search is also a file to paste into Search. - Checked against real records
- CI checks every field a detection reads against example OCSF records from Altiward and altiward-forwarder, so a rule can't depend on a field neither project sends.
Get altiward-siem on GitHub.
The rules, the searches, the Deploy to Azure template and how to contribute a detection are in the repository.