We have a SIEM in our environment that we're currently tuning and part of that process is reducing the noise in our console.
One offense I've been working on is: Excessive Firewall Denies Between Hosts containing Session Denied.
The rule that is triggering from the traffic and generating the offense is: Anomaly: Excessive Firewall Denies from a Single Source. The rule is constructed as follows:
- and when any of these BB:CategoryDefinition: Firewall or ACL Denies with the same source IP more than 400 times, across exactly 1 destination IP within 10 minutes
I took a sample of 10/20 offenses and looked at the traffic and confirmed the traffic is hitting our external interface in the DMZ and it is being denied by our firewalls. No allows.
Since we are generating a lot of noise in our console, I raised the timing threshold in the rule from
10 minutes to
15 minutes which was still triggering offenses. I then upped it from
15 minutes to
My question is, since the denies we are seeing are legitimate denies, should I increase the threshold of time and/or instances for the rule to trigger an offense so I only see a sustained attack to our public facing IP's? What risks would incur if I made this change, if any?
Thanks for the assistance!