malicious behavior detection rule exceptions not always working

[joseph-coulter]

Describe the bug:

malicious behavior detection rule exceptions not always preventing alerts that match the exception logic.

Kibana/Elasticsearch Stack version:

v 8.15.1

Server OS version:

Browser and Browser OS versions:

Elastic Endpoint version:

We have phased rollouts, so it varies.

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Security alerts.

Steps to reproduce:

Reproduction depends on the alert, and can't be done reliably because sometimes an edit to an exception seems to work, however, I'll outline my method of confirming that the exception should have prevented an alert that was triggered.

1. Make sure the excepted fields match the alert.
2. Check the "updated" timestamp in the exception and confirm that the timestamp in the alert is after the last update in the exception. later steps will change the date, so you could lose your chance to do this step if you don't do it now.
3. Click three dots in top right corner of exception, click "edit rule exception"
4. Don't change anything about the alert. Scroll down and check the "close all alerts that match this exception and were generated by selected rule/s". Click the "edit rule exception" button in the bottom right.
5. Pay attention to the bottom right of the browser to see the pop up mentioning the number of alerts closed.

Because the date of the last edit to the exception was before the date of the alert, and editing the alert without changing it closes that alert, I believe that's sufficient to rule out any issues with the exception logic and confirm that the exception logic should have prevented the alert from triggering.

Current behavior:

Sometimes exceptions don't prevent alerts that match the exception logic

Expected behavior:

Exception should prevent alerts from triggering if they match the exception logic.

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

I don't actually know if this happens exclusively with the endpoint security alert. I may have only seen it in that alert because it accounts for a very large portion of alerts in my environment. It's also notable that because there are so many malicious behavior detection alerts, and they all are categorized as one alert called "endpoint security", this causes every single malicious behavior detection alert exception to apply to one rule, and as a result, the endpoint security alert has what might be considered a large number of exceptions, around 50 right now. If that turns out to be an issue, I can move a few that really should be endpoint exceptions rather than rule exceptions, however by the time I'm done tuning that alert it'll likely be hundreds of exceptions.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[joseph-coulter]

Hi Yara, since there are some issues with reproducing the issue, I can try to wait for an alert I feel shouldn't have triggered and once that happens I could screenshare and demonstrate the process that convinced me the exception isn't working properly if you'd like. Thanks.

[yctercero]

Hi @joseph-coulter ! That would be great. Usually what is most helpful in these scenarios is to gather:

• mappings of the source index (at least for relevant fields that you're adding an exception for)
• sample alert that you expected to not have been created
• export of the exception (not just a UI screenshot)

Please remember this is a public ticket so please don't share any sensitive information. You can also feel free to reach out to me directly in our community Slack to share more info.

[yctercero]

Closing out as we determined the issue was using a field in the exception that was only available for alert documents.

Following up on Slack to help figure out a good workflow for their use case.