Run Book - Technical Preview
Also available as:
PDF

Threat Triage Alert Panel

To view the Threat Triage Alert Panel in Kafka, complete the following steps. An alert in the indexing topic in Kafka will appear similar to the following:

  1. List the Kafka topics to find the threat triage alert panel:

    /usr/hdp/current/kafka-broker/bin/kafka-topics.sh --zookeeper $ZOOKEEPER_HOST:2181 --list
  2. View the threat triage alert Kafka topic:

    cd $METRON_HOME/bin/.stellar
    THREAT_TRIAGE_PRINT(conf)

    The topic should appear similar to the following:

> THREAT_TRIAGE_PRINT(conf)
╔═══════════════════╤═════════╤══════════════════════════════════════════════════════════════════╤═══════╤═══════════════════════════════════════════════════════════════════════════════════╗
║ Name              │ Comment │ Triage Rule                                                      │ Score │ Reason                                                                                                                                 ║
╠═══════════════════╪═════════╪══════════════════════════════════════════════════════════════════╪═══════╪═══════════════════════════════════════════════════════════════════════════════════╣
║ Abnormal DNS Port │         │ source.type == "bro" and protocol == "dns" and ip_dst_port != 53 │ 10    │ FORMAT("Abnormal DNS Port: expected: 53, found: %s:%d", ip_dst_addr, ip_dst_port) ║
╚═══════════════════╧═════════╧═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════