Update normalized-threat-rules.md - #6992
Conversation
Adds new detection passthrough classes and reflects current state of migration
| |---|---|---|---| | ||
| | `runtime` | [Normalized Runtime Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01159.md) | `device_hostname` | Completed August 4, 2026 | | ||
| | `identity` | [Normalized Identity Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01161.md) | `user_username` | Completed August 4, 2026 | | ||
| | `network` | [Normalized Network Detection](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S01162.md) | `srcDevice_hostname` | Target: August 13, 2026 | |
There was a problem hiding this comment.
Verified against the live rule: MATCH-S01162's summaryExpression is "Network detection: {{threat_signalName}} from {{srcDevice_ip}}", and srcDevice_ip is the first entity selector. The primary asset field for this row should be srcDevice_ip, not srcDevice_hostname (which may be null for sources that don't report a hostname). Every other row's "Primary asset field" correctly matches its rule's summary expression (confirmed MATCH-S01159 uses device_hostname, matching its row) — this one row is the exception.
| * **runtime**. Container and cloud-native runtime detections from workload security agents: Falco, Sysdig Secure, Twistlock (Prisma Cloud Compute), and Aqua Security. | ||
| * **identity**. Identity and access anomaly detections, such as risky sign-ins, impossible travel, and compromised credentials: Azure AD Identity Protection, Microsoft ATA, Microsoft Graph Identity API, MCAS/Defender for Cloud Apps, Google Workspace Alert Center, Slack Enterprise, Okta, DocuSign Monitor, Exabeam, Salesforce, Box, and CrowdStrike Identity Protection. | ||
| * **network**. Network-layer, NDR, and WAF detections, such as IDS/IPS alerts, command-and-control callbacks, and lateral movement indicators: Kemp LoadMaster WAF, Palo Alto Firewall, FortiGate, FireEye NX/CMS, Vectra AI, Claroty xDome, Darktrace, AlphaSOC, CrowdStrike FDR, Bitdefender, and Trend Micro. | ||
| * **data_protection**. DLP, email security, deception, and application security detections: Egnyte DLP, Varonis, Netskope, Akamai CPC, Noname API Security, Check Point Avanan, Proofpoint TRAP, Mimecast, Thinkst Canary, Contrast ADR, Qualys, IBM Guardium, Office 365 DLP, CrowdStrike DataProtection, Fortinet, and Google Workspace. |
There was a problem hiding this comment.
Contrast ADR is listed here under data_protection, but the Aug 4, 2026 content release (blog-cse/2026-08-04-content.md) shipped it under runtime instead: "Runtime detections from Falco, Sysdig Secure, Twistlock (Prisma Cloud Compute), Aqua Security, and Contrast ADR now route to... MATCH-S01159", and the Log Mappers changelist includes "Contrast Security ADR Default Mapping" alongside the other runtime mappers. MATCH-S01159's own descriptionExpression also lists Contrast ADR as an example. This bullet list looks copied from the original July 14 plan (which did put it under data_protection) without picking up the Aug 4 reclassification.
| Classes are assigned per log mapping, not per vendor, so a single security product can contribute to several classes. For example, out-of-the-box CrowdStrike log mappings are assigned to `endpoint`, `identity`, `network`, and `data_protection`. | ||
|
|
||
| * **runtime**. Container and cloud-native runtime detections from workload security agents: Falco, Sysdig Secure, Twistlock (Prisma Cloud Compute), and Aqua Security. | ||
| * **identity**. Identity and access anomaly detections, such as risky sign-ins, impossible travel, and compromised credentials: Azure AD Identity Protection, Microsoft ATA, Microsoft Graph Identity API, MCAS/Defender for Cloud Apps, Google Workspace Alert Center, Slack Enterprise, Okta, DocuSign Monitor, Exabeam, Salesforce, Box, and CrowdStrike Identity Protection. |
There was a problem hiding this comment.
Exabeam is listed here as a migrated identity source, but the Aug 4, 2026 content release notes (blog-cse/2026-08-04-content.md), which this section says completed the identity migration, list the identity vendors that migrated and Exabeam isn't among them, nor is there an Exabeam entry in that release's Log Mappers changelist (unlike every other identity vendor named here). It was in the original July 14 target list, but nothing confirms it actually shipped. Worth double-checking with the CSE content team before claiming it's migrated — a customer who's already re-scoped MATCH-S00402 tuning off Exabeam based on this doc could miss detections if it's still on direct.
| * Varonis UBA | ||
| * G Suite Alert Center | ||
|
|
||
| Out-of-the-box log mappings for behavior-based detections are being migrated to six more granular classes. See [Behavioral detection classes](#behavioral-detection-classes). After migration, `direct` is retained for out-of-the-box mappings from generic sources that can't be assigned to a single class, such as the Microsoft Graph Security API catch-all mappings. |
There was a problem hiding this comment.
Minor style inconsistency: this new prose uses straight apostrophes (can't, aren't, won't, haven't, source's on lines 102/122/124), but the rest of this file and the majority of docs/cse/ use curly apostrophes (e.g. line 33's doesn't/they'll, both pre-existing). Worth a copyedit pass for consistency within the file.
| :::note | ||
| All six rules are available now, but out-of-the-box log mappings are migrating in phases. The `runtime` and `identity` mappings have migrated. The remaining dates in the table are targets and may shift. For the actual dates that out-of-the-box mappings migrate, monitor the [Cloud SIEM content release notes](/release-notes-cse/). Until a source's out-of-the-box mappings are migrated, its records keep a `threat_ruleType` of `direct` and continue to fire [Normalized Security Signal](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/rules/MATCH-S00402.md). | ||
|
|
||
| This migration changes only out-of-the-box log mappings. Your own log mappings aren't affected, and they keep whatever `threat_ruleType` value you set. To send records from your own mappings to one of the new rules, set `threat_ruleType` to that class. |
There was a problem hiding this comment.
This tells customers to "set threat_ruleType to that class" and links to Field Mapping for Security Event Sources (linked above at line 33) for mapping requirements, but that page only documents intrusion, malware, and direct — it has no sections for the six new classes. A customer following that link for guidance on entity fields, normalizedSeverity, or threat_name mapping for e.g. runtime or identity won't find anything.
2 participants
Purpose of this pull request
This pull request adds new detection passthrough classes and reflects current state of migration
Select the type of change
Ticket (if applicable)
https://sumologic.atlassian.net/browse/TLAB-2666