Host Without Firewall

Host Without Firewall. Alert means not complied. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.

Rule Content

- title: Host Without Firewall
  id: 6b2066c8-3dc7-4db7-9db0-6cc1d7b0dde9
  description: Host Without Firewall. Alert means not complied. Sigma for Qualys vulnerability
    scanner. Scan type - Vulnerability Management.
  author: Alexandr Yampolskyi, SOC Prime
  references:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  date: 2019/03/19
  status: stable
  level: low
  logsource:
    product: Qualys
    service: null
    category: null
  detection:
    selection:
      event.category: Security Policy
      host.scan.vuln_name: Firewall Product Not Detected*
    condition: selection
  tags:
  - CSC9
  - CSC9.4
  - NIST CSF 1.1 PR.AC-5
  - NIST CSF 1.1 PR.AC-6
  - NIST CSF 1.1 PR.AC-7
  - NIST CSF 1.1 DE.AE-1
  - ISO 27002-2013 A.9.1.2
  - ISO 27002-2013 A.13.2.1
  - ISO 27002-2013 A.13.2.2
  - ISO 27002-2013 A.14.1.2
  - PCI DSS 3.2 1.4

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='(event.category:"Security\ Policy" AND host.scan.vuln_name.keyword:Firewall\ Product\ Not\ Detected*)')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()