Closed GrassfedMeatSticks closed 1 year ago
Hi @GrassfedMeatSticks,
Thanks for getting in touch with us about this issue. Its an interesting problem and one that we haven't yet engineered for. If you have some ideas, and would like to add to the project, I'd be happy to work with you to add this feature.
On the commercial side, we have many different filters (called annotations) which recognise particular attributes of an alert. It then allows us to confidently say that this alert is created from MSFT defender or other scanners or AV.
This seems like a problem we might run into as well soon as we're currently working to deploy that. Just informing I'm open to collaborate. If no solution is at hand, good chance I will create one but have to wait for it to be rolled out before I can replicate the problem.
Hi @jayjb and @frosit ,
Apologies for the delay.
I don't really have any ideas, but I did contact the commercial side of the house. Their response was thoughtful and perhaps helpful for this project (see below).
The TLDR of their responses is that we should consider excluding the honeypot IPs from M365 Defender and disabling the SNMP filter on the OpenCanary.
I haven't had time to tinker with our OpenCanarys (OpenCanaries?) but I will report back on this thread when I do.
Me: I've been playing with your open source OpenCanary project and was curious how the paid version of Canary handles Microsoft Defender Endpoint Standard Discovery?
The paid for version of Canary will generally require a much higher bar of “badness” before firing off an alert. For instance, if the Canary has a file share (SMB) and a web server (HTTP) configured, alerts will only be sent when a file is accessed or an attempt is made to login to the web server. So you won't easily get false positive alerts. The SaaS console, which is also included in the paid version, has various features for handling activity from known systems including “Annotations”. This works by detecting patterns in the initial and subsequent alerts generated by systems/applications (e.g.MSFT Defender) when they interact with a Canary.MSFT Defender appears to make a SIP & HTTP proxy request before firing off a port scan against the target. This activity would send alerts to the management console. The console will flag and suppress the alert as coming from Defender if the alert pattern is encountered. You can opt to ignore similar alerts in the future as well. Another method to deal with Defender triggering alerts on your Canaries is to apply the recommendation from Microsoft, that is to add devices (such as honeypots) to an exclusion list. You can add the IP of your OpenCanary instance to this list as well. In general, OpenCanary and the paid products are pretty different products.
Me: What about other miscellaneous SNMP false positives?
Early on we did have SNMP as one of the services available on the Canary devices. We have since removed it from the paid for version because it was too noisy (as you have found out - there are a lot of SNMP probes on most networks!). We take this approach with all Canary services, if the signal is low, we remove it. The OpenCanary gets triggered every time an endpoint pings the canary on ports 22, 80, and 161 and these are all false positives. Although these might seem to be “false positives” OpenCanary is doing its job here (I.e. it is letting you know when it is being touched). We recommend adding its IP address to the exclusion list (as mentioned above).
Hi everyone,
Is there a good way to filter out specific, known-false positive detections?
I had posted earlier about some benign SNMP traffic on Issue #227 and am now seeing detections on ports 22, 80, and 161 from Microsoft 365 Defender's recommended Standard Discovery configuration.
I reviewed #169 and wasn't sure if there was something like a REQUESTS.ignorelist like the
"ip.ignorelist": ["192.168.1.1", "192.168.123.45"],
in the referenced issue or if there would be a better way to filter out these M365 standard discovery requests.Here's a sample M365 standard discovery detection
I wonder how the commercial version of the Canary handles these?