carrydela/artex
1
0
Fork 0
Code Issues Pull Requests Actions 10 Packages Projects Releases Wiki Activity

First Commit
ci / go (push) Waiting to run
Details
ci / go-db (agent) (push) Waiting to run
Details
ci / go-db (config) (push) Waiting to run
Details
ci / go-db (db) (push) Waiting to run
Details
ci / go-db (evidence) (push) Waiting to run
Details
ci / go-db (llmrec) (push) Waiting to run
Details
ci / go-db (server) (push) Waiting to run
Details
web / web (push) Waiting to run
Details
docs / links (push) Canceled after 0s
Details
detections / detections (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
dela
2026-10-09 08:38:16 +08:00
commit 0335d572de
756 changed files with 201663 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/tests/sigma_match/events/artex_enrich_user_agent.json
+10
View File
@@ -0,0 +1,10 @@
{
"note": "webserver access log. The rule matches cs-user-agent EXACTLY equal to 'artex-enrich/1.0' (enrich/enrich.go:233). A browser UA, and the same UA with a trailing suffix, must not match.",
"positive": [
{"cs-method": "GET", "cs-uri-stem": "/", "cs-user-agent": "artex-enrich/1.0", "c-ip": "203.0.113.7"}
],
"negative": [
{"cs-method": "GET", "cs-uri-stem": "/", "cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0", "c-ip": "203.0.113.8"},
{"cs-method": "GET", "cs-uri-stem": "/robots.txt", "cs-user-agent": "artex-enrich/1.0 (proxied)", "c-ip": "203.0.113.9"}
]
}
detections/tests/sigma_match/events/artex_guard_audit_framing.json
+9
View File
@@ -0,0 +1,9 @@
{
"note": "application log line. The rule is an unbound keyword matching the guard's audit-control framing marker (guard/guard.go). It should match wherever the marker appears in the message, and stay quiet on an ordinary log line.",
"positive": [
{"message": "2026-10-07T03:11:09Z guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"}
],
"negative": [
{"message": "2026-10-07T03:11:09Z auth: user login ok uid=42 ip=203.0.113.8"}
]
}
detections/tests/sigma_match/events/artex_recording_proxy_ca.json
+10
View File
@@ -0,0 +1,10 @@
{
"note": "file-creation (file_event) telemetry. The rule needs TargetFilename to contain BOTH '_ca' AND 'mitmproxy-ca-cert.pem' (|all), which narrows it to ARTEX's '<dir>/_ca/mitmproxy-ca-cert.pem' layout (traffic/traffic.go). A standalone mitmproxy cert under .mitmproxy/ has the filename but not the '_ca' directory, so it must NOT match — that is the specificity the |all modifier buys.",
"positive": [
{"TargetFilename": "/home/ubuntu/.local/share/artex/data/_ca/mitmproxy-ca-cert.pem", "Image": "/opt/artex/artex"}
],
"negative": [
{"TargetFilename": "/home/ubuntu/.mitmproxy/mitmproxy-ca-cert.pem", "Image": "/usr/bin/mitmproxy"},
{"TargetFilename": "/etc/ssl/certs/ca-certificates.crt", "Image": "/usr/sbin/update-ca-certificates"}
]
}
detections/tests/sigma_match/events/artex_selfupdate_egress.json
+9
View File
@@ -0,0 +1,9 @@
{
"note": "forward-proxy egress log. The rule matches c-useragent EXACTLY equal to 'artex-selfupdate' (selfupdate/github.go), the UA ARTEX sets when it fetches its own release from GitHub. A generic client UA must not match.",
"positive": [
{"c-useragent": "artex-selfupdate", "cs-host": "github.com", "cs-uri-stem": "/Autumn-27/ARTEX/releases/latest"}
],
"negative": [
{"c-useragent": "curl/8.5.0", "cs-host": "github.com", "cs-uri-stem": "/"}
]
}
detections/tests/sigma_match/events/correlation/artex_enrich_fanout.json
+864
View File
@@ -0,0 +1,864 @@
{
"note": "webserver access log timeline for the ARTEX Enrichment Fan-Out correlation (value_count of DISTINCT cs-host >= 20, grouped by c-ip, within a 10-minute window). 'ts' is relative seconds. Breadth — distinct hosts touched, not request volume — is the signal, so a high-volume/low-breadth burst must stay quiet.",
"positive": [
{
"label": "20 distinct hosts from one source within the 10-minute window",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 25,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 50,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 75,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 100,
"c-ip": "10.0.0.9",
"cs-host": "host04.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 125,
"c-ip": "10.0.0.9",
"cs-host": "host05.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 150,
"c-ip": "10.0.0.9",
"cs-host": "host06.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 175,
"c-ip": "10.0.0.9",
"cs-host": "host07.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 200,
"c-ip": "10.0.0.9",
"cs-host": "host08.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 225,
"c-ip": "10.0.0.9",
"cs-host": "host09.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 250,
"c-ip": "10.0.0.9",
"cs-host": "host10.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 275,
"c-ip": "10.0.0.9",
"cs-host": "host11.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 300,
"c-ip": "10.0.0.9",
"cs-host": "host12.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 325,
"c-ip": "10.0.0.9",
"cs-host": "host13.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 350,
"c-ip": "10.0.0.9",
"cs-host": "host14.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 375,
"c-ip": "10.0.0.9",
"cs-host": "host15.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 400,
"c-ip": "10.0.0.9",
"cs-host": "host16.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 425,
"c-ip": "10.0.0.9",
"cs-host": "host17.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 450,
"c-ip": "10.0.0.9",
"cs-host": "host18.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 475,
"c-ip": "10.0.0.9",
"cs-host": "host19.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
}
]
}
],
"negative": [
{
"label": "below the breadth threshold: only 19 distinct hosts",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 25,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 50,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 75,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 100,
"c-ip": "10.0.0.9",
"cs-host": "host04.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 125,
"c-ip": "10.0.0.9",
"cs-host": "host05.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 150,
"c-ip": "10.0.0.9",
"cs-host": "host06.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 175,
"c-ip": "10.0.0.9",
"cs-host": "host07.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 200,
"c-ip": "10.0.0.9",
"cs-host": "host08.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 225,
"c-ip": "10.0.0.9",
"cs-host": "host09.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 250,
"c-ip": "10.0.0.9",
"cs-host": "host10.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 275,
"c-ip": "10.0.0.9",
"cs-host": "host11.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 300,
"c-ip": "10.0.0.9",
"cs-host": "host12.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 325,
"c-ip": "10.0.0.9",
"cs-host": "host13.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 350,
"c-ip": "10.0.0.9",
"cs-host": "host14.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 375,
"c-ip": "10.0.0.9",
"cs-host": "host15.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 400,
"c-ip": "10.0.0.9",
"cs-host": "host16.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 425,
"c-ip": "10.0.0.9",
"cs-host": "host17.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 450,
"c-ip": "10.0.0.9",
"cs-host": "host18.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
}
]
},
{
"label": "20 distinct hosts but spread over ~13 minutes, so no single 10-minute window sees 20",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 40,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 80,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 120,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 160,
"c-ip": "10.0.0.9",
"cs-host": "host04.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 200,
"c-ip": "10.0.0.9",
"cs-host": "host05.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 240,
"c-ip": "10.0.0.9",
"cs-host": "host06.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 280,
"c-ip": "10.0.0.9",
"cs-host": "host07.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 320,
"c-ip": "10.0.0.9",
"cs-host": "host08.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 360,
"c-ip": "10.0.0.9",
"cs-host": "host09.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 400,
"c-ip": "10.0.0.9",
"cs-host": "host10.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 440,
"c-ip": "10.0.0.9",
"cs-host": "host11.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 480,
"c-ip": "10.0.0.9",
"cs-host": "host12.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 520,
"c-ip": "10.0.0.9",
"cs-host": "host13.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 560,
"c-ip": "10.0.0.9",
"cs-host": "host14.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 600,
"c-ip": "10.0.0.9",
"cs-host": "host15.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 640,
"c-ip": "10.0.0.9",
"cs-host": "host16.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 680,
"c-ip": "10.0.0.9",
"cs-host": "host17.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 720,
"c-ip": "10.0.0.9",
"cs-host": "host18.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 760,
"c-ip": "10.0.0.9",
"cs-host": "host19.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
}
]
},
{
"label": "high volume, low breadth: 25 requests from one source but only 4 distinct hosts",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 20,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 40,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 60,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 80,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 100,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 120,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 140,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 160,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 180,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 200,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 220,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 240,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 260,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 280,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 300,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 320,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 340,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 360,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 380,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 400,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 420,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 440,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 460,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 480,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
}
]
},
{
"label": "breadth split across two sources: 10 distinct hosts each, neither source reaches 20",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "host00.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 25,
"c-ip": "10.0.0.9",
"cs-host": "host01.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 50,
"c-ip": "10.0.0.9",
"cs-host": "host02.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 75,
"c-ip": "10.0.0.9",
"cs-host": "host03.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 100,
"c-ip": "10.0.0.9",
"cs-host": "host04.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 125,
"c-ip": "10.0.0.9",
"cs-host": "host05.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 150,
"c-ip": "10.0.0.9",
"cs-host": "host06.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 175,
"c-ip": "10.0.0.9",
"cs-host": "host07.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 200,
"c-ip": "10.0.0.9",
"cs-host": "host08.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 225,
"c-ip": "10.0.0.9",
"cs-host": "host09.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 0,
"c-ip": "10.0.0.10",
"cs-host": "host10.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 25,
"c-ip": "10.0.0.10",
"cs-host": "host11.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 50,
"c-ip": "10.0.0.10",
"cs-host": "host12.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 75,
"c-ip": "10.0.0.10",
"cs-host": "host13.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 100,
"c-ip": "10.0.0.10",
"cs-host": "host14.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 125,
"c-ip": "10.0.0.10",
"cs-host": "host15.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 150,
"c-ip": "10.0.0.10",
"cs-host": "host16.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 175,
"c-ip": "10.0.0.10",
"cs-host": "host17.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 200,
"c-ip": "10.0.0.10",
"cs-host": "host18.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 225,
"c-ip": "10.0.0.10",
"cs-host": "host19.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
}
]
}
]
}
detections/tests/sigma_match/events/correlation/artex_enrich_scan_velocity.json
+979
View File
@@ -0,0 +1,979 @@
{
"note": "webserver access log timeline for the ARTEX Enrichment Scan Velocity correlation (event_count >= 30 probes from one c-ip within a 5-minute window). 'ts' is relative seconds. Velocity (density in time), not total count, is the signal.",
"positive": [
{
"label": "30 enrichment probes from one source inside the 5-minute window",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 9,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 18,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 27,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 36,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 45,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 54,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 63,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 72,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 81,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 90,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 99,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 108,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 117,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 126,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 135,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 144,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 153,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 162,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 171,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 180,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 189,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 198,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 207,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 216,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 225,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 234,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 243,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 252,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 261,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
}
]
}
],
"negative": [
{
"label": "below the threshold: only 29 probes",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 9,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 18,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 27,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 36,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 45,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 54,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 63,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 72,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 81,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 90,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 99,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 108,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 117,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 126,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 135,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 144,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 153,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 162,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 171,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 180,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 189,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 198,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 207,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 216,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 225,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 234,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 243,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 252,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
}
]
},
{
"label": "30 probes total but spread over ~10 minutes, so no 5-minute window reaches 30",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 20,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 40,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 60,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 80,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 100,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 120,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 140,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 160,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 180,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 200,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 220,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 240,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 260,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 280,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 300,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 320,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 340,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 360,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 380,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 400,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 420,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 440,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 460,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 480,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 500,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 520,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 540,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 560,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
},
{
"ts": 580,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "artex-enrich/1.0"
}
]
},
{
"label": "30 requests in the window but the User-Agent is a normal browser (base rule does not match)",
"events": [
{
"ts": 0,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 9,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 18,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 27,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 36,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 45,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 54,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 63,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 72,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 81,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 90,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 99,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 108,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 117,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 126,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 135,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 144,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 153,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 162,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 171,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 180,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 189,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 198,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 207,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 216,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 225,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 234,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 243,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 252,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
},
{
"ts": 261,
"c-ip": "10.0.0.9",
"cs-host": "assets.example.test",
"cs-method": "GET",
"cs-uri-stem": "/",
"cs-user-agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
}
]
}
]
}
detections/tests/sigma_match/events/correlation/artex_guard_block_burst.json
+152
View File
@@ -0,0 +1,152 @@
{
"note": "application/audit log timeline for the ARTEX Guard-Block Burst correlation (event_count >= 5 guard-control markers on one host within a 10-minute window). 'ts' is relative seconds. A single marker can be a quoted string; a burst on one host indicates an actively engaged ARTEX run.",
"positive": [
{
"label": "5 guard-control markers on one host inside the 10-minute window",
"events": [
{
"ts": 0,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 60,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 120,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 180,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 240,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
}
]
}
],
"negative": [
{
"label": "below the threshold: only 4 markers",
"events": [
{
"ts": 0,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 60,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 120,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 180,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
}
]
},
{
"label": "5 markers but spread over ~13 minutes, so no 10-minute window holds 5",
"events": [
{
"ts": 0,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 200,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 400,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 600,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 800,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
}
]
},
{
"label": "markers split across two hosts: 3 and 2, neither host reaches 5",
"events": [
{
"ts": 0,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 60,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 120,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 0,
"host": "web02",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 60,
"host": "web02",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
}
]
},
{
"label": "ordinary log lines on one host, no guard marker (base rule does not match)",
"events": [
{
"ts": 0,
"host": "web01",
"message": "auth: user login ok uid=42 ip=203.0.113.8"
},
{
"ts": 60,
"host": "web01",
"message": "auth: user login ok uid=42 ip=203.0.113.8"
},
{
"ts": 120,
"host": "web01",
"message": "auth: user login ok uid=42 ip=203.0.113.8"
},
{
"ts": 180,
"host": "web01",
"message": "auth: user login ok uid=42 ip=203.0.113.8"
},
{
"ts": 240,
"host": "web01",
"message": "auth: user login ok uid=42 ip=203.0.113.8"
}
]
}
]
}
detections/tests/sigma_match/events/correlation/artex_guard_marker_then_destructive.json
+81
View File
@@ -0,0 +1,81 @@
{
"note": "host timeline joining application/audit logs and process-creation logs for the ARTEX Guard Marker With Destructive Command temporal correlation (both referenced rules must fire on the SAME host within a 30-minute window). 'ts' is relative seconds.",
"positive": [
{
"label": "guard marker then a destructive command on the same host within 30 minutes",
"events": [
{
"ts": 0,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 600,
"host": "web01",
"CommandLine": "rm -rf / --no-preserve-root",
"Image": "/usr/bin/rm"
}
]
}
],
"negative": [
{
"label": "only the guard marker, no destructive command",
"events": [
{
"ts": 0,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 120,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
}
]
},
{
"label": "only a destructive command, no guard marker",
"events": [
{
"ts": 0,
"host": "web01",
"CommandLine": "rm -rf / --no-preserve-root",
"Image": "/usr/bin/rm"
}
]
},
{
"label": "both present but ~60 minutes apart, outside the 30-minute window",
"events": [
{
"ts": 0,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 3600,
"host": "web01",
"CommandLine": "rm -rf / --no-preserve-root",
"Image": "/usr/bin/rm"
}
]
},
{
"label": "the two legs on different hosts",
"events": [
{
"ts": 0,
"host": "web01",
"message": "guard 【ARTEX 平台管控·非目标防御】此操作被禁止: rm -rf /"
},
{
"ts": 600,
"host": "db02",
"CommandLine": "rm -rf / --no-preserve-root",
"Image": "/usr/bin/rm"
}
]
}
]
}
detections/tests/sigma_match/events/destructive_command_hunting.json
+13
View File
@@ -0,0 +1,13 @@
{
"note": "process_creation telemetry (CommandLine). The rule hunts destructive shell/DB/availability commands via '1 of selection_*', so one representative command from each of the three selection groups must match. Benign commands — including a plain 'rm' without the recursive/force flags — must not. (The rule's own false-positive note documents that lowercase coreutils 'truncate' DOES share the TRUNCATE token and must be allow-listed, so it is intentionally not used here as a negative.)",
"positive": [
{"CommandLine": "rm -rf /var/www/html", "Image": "/usr/bin/rm"},
{"CommandLine": "mysql -u root -e 'DROP TABLE customers'", "Image": "/usr/bin/mysql"},
{"CommandLine": "iptables -F", "Image": "/usr/sbin/iptables"}
],
"negative": [
{"CommandLine": "ls -la /var/www/html", "Image": "/usr/bin/ls"},
{"CommandLine": "rm /tmp/scratch.txt", "Image": "/usr/bin/rm"},
{"CommandLine": "git status", "Image": "/usr/bin/git"}
]
}