Chronicle Detection Rules
This repository contains sample detection rules for use within Chronicle.
Rules within the soc_prime_rules directory were created by SOC Prime and made available to Chronicle Customers.
Getting Started
Rules can be created within your Chronicle instance by using the Rules Editor. Simply download the rule from the repository and copy the content of the rule to the rule editor when creating a new rule.
To automate rule creation, APIs are available to create/update/delete rules.
Detailed instructions can be found in your Chronicle instance under documentation:
Documentation
Detection API and UI:
- https://cloud.google.com/chronicle/docs/reference/detection-engine-api
- https://cloud.google.com/chronicle/docs/how-to#monitoring-events-using-rules
YARA-L 2.0 rules and UDM:
- https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-overview
- https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax
- https://cloud.google.com/chronicle/docs/unified-data-model/udm-usage
- https://cloud.google.com/chronicle/docs/reference/udm-field-list
Code Samples
https://github.com/chronicle/api-samples-python/tree/master/detect/v2