Creating threat categories from policy rules

Edit online

To manage policy violations as security threats in the Active threat analytics dashboard, you can configure your policy rules as threat categories.

Before you begin

Policies must be created in Policy Builder before you create a custom threat category. For more information, see Creating and installing a policy and policy rules.
Only policy rules with High severity and actions from the Alert or Log groups that generate violations can be configured as threat categories. For example, Alert Only and Log Full Details actions cannot be used to create a threat category as they do not generate violations..

About this task

To set up a policy rule as a category, you need to specify a threshold. When the rule threshold is exceeded in any 1 hour, a case is created and displayed in the Active Threat Analytics dashboard. The case type is the name of the policy rule.

Changes to installed policies are applied according to the policy schedule. When you set up a rule in an installed policy as a threat category, cases are created for policy violations only after the policy is reinstalled.

Creating a threat category in Guardium 12.2.3 and later

Edit online

Create a custom threat detection category based on existing policies and rules.

Before you begin

12.2.3 and later This feature is available in 12.2.3 and later versions of Guardium®.

Procedure

From the Active threat analytics dashboard, click Setup > Create category.
Select the Policy rule based category type.
All installed policies and their associated rules are displayed.
Select the policy and rules that you want to monitor.
Only rules with High severity are available for selection.
In the Threshold field, enter the number of violations that trigger a threat case.
For example, if you set the threshold to 5, a case is created after 5 violations.
In the Description field, provide a clear explanation of what this category detects.
Click Create.

Results

The custom policy-based category is created and available for enabling.

What to do next

You can edit the threshold value for custom threat categories by completing the following steps:

From the Active threat analytics page, go to Setup > Threat processes.
Select the custom threat category that you want to modify, then click Edit.
Update the Threshold value.
You can not edit the policy name, rule name, or category description for custom threat categories.
Save the changes.

Creating a threat category in Guardium 12.2.2 and earlier

Edit online

You can add a threat category from the Active Threat Analytics dashboard by selecting a policy, policy rule, and setting a threshold to create Active threat analytics cases.

Before you begin

12.2 and later This feature is available in 12.2 and later versions of Guardium.

Procedure

Navigate to the Active Threat Analytics Setup page.
- 12.2.x and later From the Active Threat Analytics dashboard, click Active Threat Analytics Setup.
- 12.2.2 and later From the Active Threat Analytics dashboard, click Setup.
Under the Categories section, click the Plus icon to add a category.
To add a threat category based on a policy rule, click A Policy rule.
Select a policy from the Policy dropdown list.
Select a policy rule from the Policy rule dropdown list.
In the Threshold field, set the threshold for the policy rule.
If the number of policy violations in one hour meets or exceeds this threshold, an Active threat analytics case is triggered.
To create the threat category, click Add.

Creating a threat category by using API

Edit online

You can add a threat category by using API commands to select the policy and policy rules, and configure the threshold.

Procedure

Identify the policy and policy rule that you want by using the API commands list_policy and list_policy_rules.
Important: In Guardium Data Protection version 12.1 and earlier, you can not create threat categories from custom policy rules. You must select one of the following predefined policy rules to create a threat category successfully:
- Cross-site scripting
- OS command injection
- SQL Injection: Denial of Service
- SQL Injection: Side channel
- SQL Injection: Tautology
Add or modify the threshold by using the API command add_threshold_to_rule or update_threshold_in_rule. In the following example, threshold=25 is added to ruleNNN in policyAAA.
```
grdapi add_threshold_to_rule policy_name=policyAAA rule_name=ruleNNN threshold=25
```

Results

After the policy is updated, it takes one day for the threat category to activate. When the category is activated, a case is created when the rule threshold is exceeded in a time frame of one hour.