correlating-security-events-in-qradar

在 QRadar 中关联安全事件

何时使用

在以下情况下使用本技能：

• SOC 分析师需要调查 QRadar offense 并跨多个日志源关联事件
• 检测工程师构建自定义关联规则以识别多阶段攻击
• 需要调优告警以减少误报 offense 并提升信号质量
• 团队从基础事件监控迁移到基于行为的关联

请勿使用于日志源接入或解析——那需要 QRadar 管理员权限和 DSM 编辑器知识。

前提条件

• 已启用 offense 管理的 IBM QRadar SIEM 7.5+
• 具备用于临时事件和流查询的 AQL 知识
• 日志源已规范化并具有正确的 QID 映射（Windows、防火墙、代理、终端）
• 用户角色具有 offense 管理、规则创建和 AQL 搜索权限
• 已为白名单和监视列表管理配置参考集/参考映射

工作流

第 1 步：使用 AQL 调查 Offense

在 QRadar 中打开一个 offense，并使用 AQL（Ariel Query Language）查询相关事件：

SELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceIP, destinationIP, username,
       LOGSOURCENAME(logSourceId) AS log_source,
       QIDNAME(qid) AS event_name,
       category, magnitude
FROM events
WHERE INOFFENSE(12345)
ORDER BY startTime ASC
LIMIT 500

以源 IP 为枢纽查找所有活动：

SELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       destinationIP, destinationPort, username,
       QIDNAME(qid) AS event_name,
       eventCount, category
FROM events
WHERE sourceIP = '192.168.1.105'
  AND startTime > NOW() - 24*60*60*1000
ORDER BY startTime ASC
LIMIT 1000

第 2 步：构建自定义关联规则

创建一个多条件规则，检测暴力破解后登录成功的情况：

规则 1 — 暴力破解检测（构建块）：

Rule Type: Event
Rule Name: BB: Multiple Failed Logins from Same Source
Tests:
  - When the event(s) were detected by one or more of [Local]
  - AND when the event QID is one of [Authentication Failure (5000001)]
  - AND when at least 10 events are seen with the same Source IP
    in 5 minutes
Rule Action: Dispatch new event (Category: Authentication, QID: Custom_BruteForce)

规则 2 — 暴力破解成功（关联规则）：

Rule Type: Offense
Rule Name: COR: Brute Force with Subsequent Successful Login
Tests:
  - When an event matches the building block BB: Multiple Failed Logins from Same Source
  - AND when an event with QID [Authentication Success (5000000)] is detected
    from the same Source IP within 10 minutes
  - AND the Destination IP is the same for both events
Rule Action: Create offense, set severity to High, set relevance to 8

第 3 步：使用 AQL 进行跨源关联

将认证失败与网络流关联，以检测横向移动：

SELECT e.sourceIP, e.destinationIP, e.username,
       QIDNAME(e.qid) AS event_name,
       e.eventCount,
       f.sourceBytes, f.destinationBytes
FROM events e
LEFT JOIN flows f ON e.sourceIP = f.sourceIP
  AND e.destinationIP = f.destinationIP
  AND f.startTime BETWEEN e.startTime AND e.startTime + 300000
WHERE e.category = 'Authentication'
  AND e.sourceIP IN (
    SELECT sourceIP FROM events
    WHERE QIDNAME(qid) = 'Authentication Failure'
      AND startTime > NOW() - 3600000
    GROUP BY sourceIP
    HAVING COUNT(*) > 20
  )
  AND e.startTime > NOW() - 3600000
ORDER BY e.startTime ASC

通过将 DNS 查询与大量出站流关联来检测数据外泄：

SELECT sourceIP, destinationIP,
       SUM(sourceBytes) AS total_bytes_out,
       COUNT(*) AS flow_count
FROM flows
WHERE sourceIP IN (
    SELECT sourceIP FROM events
    WHERE QIDNAME(qid) ILIKE '%DNS%'
      AND destinationIP NOT IN (
        SELECT ip FROM reference_data.sets('Internal_DNS_Servers')
      )
      AND startTime > NOW() - 86400000
    GROUP BY sourceIP
    HAVING COUNT(*) > 500
  )
  AND destinationPort NOT IN (80, 443, 53)
  AND startTime > NOW() - 86400000
GROUP BY sourceIP, destinationIP
HAVING SUM(sourceBytes) > 104857600
ORDER BY total_bytes_out DESC

第 4 步：配置参考集以丰富上下文

为动态白名单和监视列表创建参考集：

# Create reference set via QRadar API
curl -X POST "https://qradar.example.com/api/reference_data/sets" \
  -H "SEC: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Known_Pen_Test_IPs",
    "element_type": "IP",
    "timeout_type": "LAST_SEEN",
    "time_to_live": "30 days"
  }'

# Add entries
curl -X POST "https://qradar.example.com/api/reference_data/sets/Known_Pen_Test_IPs" \
  -H "SEC: YOUR_API_TOKEN" \
  -d "value=10.0.5.100"

在规则条件中使用参考集，以排除已知的良性活动：

Test: AND when the Source IP is NOT contained in any of [Known_Pen_Test_IPs]
Test: AND when the Destination IP is contained in any of [Critical_Asset_IPs]

第 5 步：调优 Offense 生成

通过添加构建块过滤器减少误报：

-- Find top false positive generators
SELECT QIDNAME(qid) AS event_name,
       LOGSOURCENAME(logSourceId) AS log_source,
       COUNT(*) AS event_count,
       COUNT(DISTINCT sourceIP) AS unique_sources
FROM events
WHERE INOFFENSE(
    SELECT offenseId FROM offenses
    WHERE status = 'CLOSED'
      AND closeReason = 'False Positive'
      AND startTime > NOW() - 30*24*60*60*1000
  )
GROUP BY qid, logSourceId
ORDER BY event_count DESC
LIMIT 20

应用调优：

• 将高频误报源添加到参考集排除项
• 提高噪声规则的事件阈值（例如，服务账户从 10 次失败登录调整为 25 次）
• 设置 offense 合并，将相关事件归组到单个 offense 下

第 6 步：构建用于关联监控的自定义仪表板

创建一个包含关键关联指标的 QRadar Pulse 仪表板：

-- Active offenses by category
SELECT offenseType, status, COUNT(*) AS offense_count,
       AVG(magnitude) AS avg_magnitude
FROM offenses
WHERE status = 'OPEN'
GROUP BY offenseType, status
ORDER BY offense_count DESC

-- Mean time to close offenses
SELECT DATEFORMAT(startTime, 'yyyy-MM-dd') AS day,
       AVG(closeTime - startTime) / 60000 AS avg_close_minutes,
       COUNT(*) AS closed_count
FROM offenses
WHERE status = 'CLOSED'
  AND startTime > NOW() - 30*24*60*60*1000
GROUP BY DATEFORMAT(startTime, 'yyyy-MM-dd')
ORDER BY day

关键概念

术语	定义
AQL	Ariel Query Language——QRadar 的类 SQL 查询语言，用于搜索事件、流和 offense
Offense	QRadar 的关联事件，将多个事件/流归组到单个调查单元下
构建块	可复用的规则组件，可对事件进行分类但不生成 offense，用作关联规则的输入
严重度	QRadar 计算出的 offense 严重程度，综合相关性、严重性和可信度评分（1-10）
参考集	QRadar 中的动态查找表，用于规则中使用的白名单、监视列表和丰富数据
QID	QRadar 标识符——将供应商特定事件映射到规范化类别的唯一数字 ID
合并	QRadar 将相关事件归组到单个 offense 以减少分析师工作量的机制

工具与系统

• IBM QRadar SIEM：企业级 SIEM 平台，具备事件关联、offense 管理和 AQL 查询引擎
• QRadar Pulse：用于构建 offense 和事件指标自定义可视化的仪表板框架
• QRadar API：用于自动化参考集管理、offense 操作和规则部署的 RESTful API
• QRadar Use Case Manager：用于将检测规则映射到 MITRE ATT&CK 框架覆盖范围的应用
• QRadar Assistant：由 AI 驱动的分析工具，帮助分析师使用自然语言调查 offense

常见场景

• 暴力破解导致失陷：将失败的认证事件与随后来自同一来源的成功登录进行关联
• 横向移动链：跟踪来自单一来源、跨多台内部主机的认证事件
• C2 信标：将周期性 DNS 查询与发送至异常域名的低熵载荷进行关联
• 权限提升：将用户账户变更（加入组）与先前的可疑认证进行关联
• 数据外泄：将大量出站流量与先前的内部侦察活动进行关联

输出格式

QRADAR OFFENSE INVESTIGATION — Offense #12345
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Offense Type:   Brute Force with Subsequent Access
Magnitude:      8/10 (Severity: 8, Relevance: 9, Credibility: 7)
Created:        2024-03-15 14:23:07 UTC
Contributing:   247 events from 3 log sources

Correlation Chain:
  14:10-14:22  — 234 Authentication Failures (EventCode 4625) from 192.168.1.105 to DC-01
  14:23:07     — Authentication Success (EventCode 4624) from 192.168.1.105 to DC-01 (user: admin)
  14:25:33     — New Process: cmd.exe spawned by admin on DC-01
  14:26:01     — Net.exe user /add detected on DC-01

Sources Correlated:
  Windows Security Logs (DC-01)
  Sysmon (DC-01)
  Firewall (Palo Alto PA-5260)

Disposition:    TRUE POSITIVE — Escalated to Incident Response
Ticket:         IR-2024-0432