AnsweredAssumed Answered

Generating alerts from FIM data

Question asked by Robert Barrow on Apr 30, 2019
Latest reply on Feb 14, 2020 by Lavish Jhamb
  • Comment • 2

We are using the Cloud Agents with FIM enabled in our cloud infrastructure as a replacement for AIDE. Is there any way to create alerts based on a set of criteria? We would want either emails to be sent out or possibly nagios triggers to be used.

 

Would there be a way of doing this through the API?

 

Thanks in advance.

Lavish Jhamb
Lavish Jhamb Employee Feb 14, 2020 2:46 AM
Correct Answer
You can configure Qualys FIM to monitor critical events/incidents based on the conditions specified in a rule and receive alerts via specified messaging system which includes Email, PagerDuty or Post to Slack.
 
For example, alerts can be configured for Unauthorized Modification of Critical Authentication files on Linux System as follows:
Configure a QQL as - (platform: Linux and (file.name: passwd or file.name: shadow or file.name: password-auth or file.name: system-auth and (action:Delete or action: Security or action: Content)) and not actor.userName: root)
 
This serves as a condition which can be scheduled to run using following trigger criteria:
Single Match - if you want the system to generate an alert each time the system detects an event/incident matching your search query.
 
Time-Window Count Match - when you want to generate alerts based on the number of events/incidents returned by the search query in a fixed time interval. For example, an alert will be sent when three matching events are found within 15 minutes window.
 
Time-Window Scheduled Match - when you want to generate alerts for matching events or incidents found during a scheduled time. The rule will be triggered only when an event/incident matching your search criteria is found during the time specified in the schedule. Choose a date and time range for creating a schedule and specify how often you want to run the schedule for example,  daily, weekly and monthly. For example, send daily alerts with all matches in a scheduled window between 4.56 pm and 5.56 pm.
 
API support to generate alerts is scheduled for next release.
See the reply in context
No one else had this question

Outcomes