Tutorial: Create a New Directive to Detect DoS Attack

Applies to Product: USM Appliance™ LevelBlue OSSIM®

Sometimes, you may find that none of the built-in directives work in your environment because they do not have the correct conditions defined. In this case, you can create a new directive from scratch. Let’s see how it works by going through an example.

In this example, we create a custom directive to detect a Denial of Service (DoS) attack that seeks to exhaust a service running on TCP port 139 on a specific server. Many connections from a single host (possibly with bad reputation) to the destination server on port 139 may indicate such an attack. We can check firewall events for connections to the server and trigger an alarm after the correlation engine detects that the number of connections is dangerously high.

The following diagram shows the three correlation levels we plan to use in the directive. The three correlation rules check for the number of connections to the server using a detector plugin. Every time a rule in the correlation directive matches an event, the reliability of the directive event increases, thus increasing the risk of the event.

Correlation levels used by the sample directive.

Correlation levels used by the sample directive

Follow the tasks below to create this directive.

To create a new directive

  1. Go to Configuration > Threat Intelligence, and then click Directives.

  2. Click New Directive.

    A pop-up window appears displaying the global properties of the directive.

  3. Fill out the form as below

    • In Name for the directive, Type "DoS Attack at NetBIOS".
    • In Intent select "Delivery & Attack".
    • In Strategy select "Denial of Service – Resource exhaustion".
    • In Method, type "Attack".
    • Leave the Priority at the default value, which is 3.

  4. Click Next.

    The New Directive window displays.

This task adds a level 1 rule for the directive created in Task 1. In this rule, we try to match one Cisco ASA Access Permitted event on a particular server on port 139.

To add a level 1 rule

  1. In Name for the Rule, type "Established connections", and then click Next.
  2. In Rule name > Plugin, type "cisco-asa" in the search box, and then click Cisco-ASA.

  3. In Rule name > Plugin > Event Type,

    1. Type "permitted" in the search box.

      A list of ASA event types with the word "permitted" in their description displays in the right column.

    2. To select the event types identified, click the plus (+) sign to the right of each event type or click Add all.

    3. Click Next.

  4. In Rule name > Plugin > Event Type > Network,

    1. Select your server from the Assets list under Destination Host / Network.

      The server appears in Destination.

      Note: Leave Source Host / Network and Source Port(s) empty, which means any asset.

    2. In Destination Port(s), type "139".

    3. (Optional) To specify IP reputation parameters, click the green triangle next to Reputation options, change No to Yes, and then select the Min Priority and Min Reliability values.

      Note: For details on IP reputation, see OTX IP Reputation.

    4. Click Next.

  5. In Rule name > Plugin > Event Type > Network > Reliability, click 1.

    Note: We choose a low reliability value because typically the level 1 rule detects that a certain event occurs, but it is not necessary to generate an alarm.

  6. Click Finish.

    The New Directive window closes.

In this task, we try to match the same events selected in Task 2. We want to use the

  • same event types
  • same source and destination IP addresses
  • same destination port

But we want to detect 100 such events instead of 1.

To add a level 2 rule

  1. Click the green plus (+) sign at the right side of the first rule, under the Action heading.

    The New Rule window displays.

  2. In Name for the Rule, type "Established connections", and then click Next.
  3. In Rule name > Plugin, type "cisco-asa" in the search box, and then click Cisco-ASA.

  4. In Rule name > Plugin > Event Type, click Plugin SID from rule of Level 1.

    This selects the same event types as in the level 1 rule.

  5. In Rule name > Plugin > Event Type > Network,

    1. In Source Host / Network, under From a parent rule, select "Source IP from level 1".

      This selects the same source IP address as in the level 1 rule.

    2. Leave the Source Ports empty.

    3. In Destination Host / Network, under From a parent rule, select "Destination IP from level 1".

      This selects the same destination IP address as in the level 1 rule.

    4. In Destination Port(s), under From a parent rule, select "Destination Port from level 1".

      This selects the same destination port as in the level 1 rule.

  6. In Rule name > Plugin > Event Type > Network > Reliability, click +2.

    Note: In this step, you can either choose an absolute value (left column) or a relative value (right column). If you select a relative value, as we did, USM Appliance adds the value to the reliability set in the previous rule.

  7. Click Finish.

    The New Directive window closes.

  8. In the Timeout column, click "None" in the second rule, type "30" (seconds), and then click OK.

  9. In the Occurrence column, click "1" in the second rule, type "100", and then click OK.

    Timeout and Occurence options in Rules section of Directives window.

This task is a repeat of Task 3. You can repeat this task as many times as necessary. In this example, we want to add another rule (level 3) to detect the same event as in the previous rule but with 1000 occurrences.

To add the level 3 rule

  1. Click the green plus (+) sign at the right side of the second rule, under the Action heading.

    The New Rule window displays.

  2. Follow step 2 to 7 in Task 3.

  3. In the Occurrence column, click "1" in the third rule, type "1000", and then click OK.

    The directive looks similar to this one

    New Rule window for adding monitor type plugin.

To apply all the changes made

  1. Click Reload Directives. The text displays in red, suggesting an action.

  2. Click Yes to confirm when prompted.

This step does not restart USM Appliance; it restarts the ossim-server process running on USM Appliance.