Documentation contents
AarSOC · How it runs
Detection and alerting
AarSOC detection rules, their MITRE ATT&CK alignment, severity levels, thresholds, false positives and the channels through which you are alerted.
On this page
The rules
- The standard rules of our detection engine, plus our own: privilege escalation, persistence, exfiltration, Active Directory attacks such as Kerberoasting, changes to sensitive files with the identity of who made them.
- Our rules are versioned and automatically tested before every deployment.
- They are aligned with MITRE ATT&CK: when the rule defines it, each alert carries the corresponding technique and tactic. Depending on the offer, a portal page shows which techniques are actually covered on your estate.
Rules specific to your business
We develop rules from the use cases you identify: abnormal behaviour on your critical applications, out-of-hours access to sensitive systems, unusual transfers. They rely on the logs already collected when the necessary data is there.
Severity
Four levels in AarView: low, medium, high, critical. For an alert from our detection engine they follow the rule level:
| Rule level | AarView severity |
|---|---|
| 7 and above | medium |
| 12 and above | high |
| 15 and above | critical |
An analyst can correct the severity during triage.
Thresholds and false positives
- Thresholds are tuned during the first weeks on your normal activity, then after every reported false positive or significant change in your environment.
- Every rule change goes through our code repository and stays traceable.
- A false positive is closed with its reason in the portal. If it recurs, the rule is refined or a documented exception is added to our versioned rules.
How you are alerted
- In the portal and by e-mail, in French then English. Each user chooses: critical alerts only, all incidents, tickets assigned to them, daily summary.
- Through a signed webhook to your tool, set up by our team: new alert, new case, status or severity change, finalised report.
- An API gives access to your incidents.
AarView, which AarSOC runs on, can send a case to Jira, ServiceNow, Slack or Microsoft Teams since version 1.77.0, every send being approved (outbound connectors): ask us to enable it for your service. There is no SMS delivery.
A critical alert also triggers on-call: see Coverage and on-call.