"New to Chronicle" is a deep-dive series by Google Cloud Principal Security Strategist John Stoner which provides practical guidance for security teams that are either new to Security Operations Platforms or replacing their Security Operations Platforms with Chronicle. You can view the entire series here.

As we reach the end of the year and approach the winter holiday season, I wanted to release one more blog in our series to put a bow on this year. CWIDT?

Today, we are going to focus on a common question that we get when users start digging into Chronicle. Where can I find rules that I can start using immediately? Now, Chronicle provides curated detections which provide admins the ability to toggle on rule packs to address specific categories of concern, like info stealer or initial access or anomalous PowerShell, to name a few. That’s a good start. However, for analysts who want to build their own rules, where can they find templates of rules to leverage as they get started? Additionally, if detection engineers want to leverage the entity graph in their rules, how can they get started joining events and entities?

This is where community rules come in! Community rules are part of our Chronicle Github repository which contains content that we are creating for workshops, blogs, conferences and research.

So, if you are just getting started with rules and would like to see an example of a multi-event rule that uses aggregation and thresholding that can be adapted to your environment, the password spray rule in community might help. This rule is also covered in our hands-on workshop on rule building!

While we have covered a number of entity graph related rules in this blog series, like this one on prevalence, there are many additional rules that we’ve created within the threat_intel folder that leverage entity graph data. If you want to take DNS events and better understand how VirusTotal relationships interact together, this rule could help.

Earlier this year we partnered with Okta and my colleague Serhat Gülbetekin to develop a set of rules that can be used in Chronicle if you are ingesting Okta data. For users building use cases around Okta, this provides a way to accelerate this development.

If you are an analyst just getting familiar with YARA-L or want to understand all of the components that should go into a rule to get the most out of it, we just released our style guide into the Github repository. This guide lays out best practices when it comes to rule writing using YARA-L. We’ve done our best to apply the concepts in the guide to the rules we publish in the community folder of the repo and align with what we evangelize in our workshops on rule development.

One word of caution when it comes to Community Rules. We build these rules to: 

• Serve as inspiration

• Provide a template for additional customization

• Show the way forward to building rules using data sets that users may not be familiar with

• Demonstrate YARA-L's capabilities

This does not mean that these rules are production ready for every environment. Chronicle provides a test rule capability that should always be used when validating any rules in your environment. Additionally, rule options allow rules to be run in the background without generating an alert. Use these tools as you tune community rules for your environment.

Finally, as we look ahead to next year, we plan to publish more community rules to assist Chronicle users in getting a leg up on detection development. The Google Cloud Security Community site is the best place to keep up with new announcements on content and best practices. In fact this month, Ali Kapucu wrote about extending visibility into Chrome with Chronicle and David French on detecting suspicious domains in Chronicle. Their rules are posted to community rules, so if you like what you see in those blogs, go and download those rules too!

Thank you for your engagement and I hope everyone has a great holiday season!