feat: add support correlation feature #97
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR adds support for correlation features by implementing a new correlation engine that can process and match events across multiple rules. The implementation introduces a new correlation rule loading system and separates output writing functionality into a dedicated module.
- Adds correlation rule loading and processing capabilities
- Refactors output writing logic into a separate module for better maintainability
- Updates function signatures to pass references instead of values for improved performance
Reviewed Changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| src/core/scan.rs | Refactors scanning functions to support correlation processing and updates parameter handling |
| src/core/rules.rs | Adds correlation rule loading functionality with comprehensive tests |
| src/cmd/aws_summary.rs | Updates function call to pass reference parameter |
| src/cmd/aws_metrics.rs | Updates function call to pass reference parameter |
| src/cmd/aws_detect_writer.rs | New module containing all output writing functionality extracted from aws_detect.rs |
| src/cmd/aws_detect.rs | Refactored to use new writer module and adds correlation processing logic |
| src/cmd.rs | Adds new aws_detect_writer module |
| Cargo.toml | Updates sigma-rust dependency to specific git revision and adds tempfile for testing |
event_counttitle: Correlation Test
id: 49d15187-4203-4e11-8acd-8736f25b6609
status: test
author: TEST
correlation:
type: event_count
rules:
- Console Login With MFA
group-by:
- sourceIPAddress
timespan: 3d
condition:
gte: 3
field: sourceIPAddress
generate: true
level: high
---
title: Console Login With MFA
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: signin.amazonaws.com
eventName: 'ConsoleLogin'
additionalEventData.MFAUsed: 'Yes'
condition: selection
level: informational
|
|
@YamatoSecurity @hach1yon |
value_counttitle: Correlation value_count Test
id: 49d15187-4203-4e11-8acd-8736f25b66xx
status: test
author: TEST
correlation:
type: value_count
rules:
- Console Login Without MFA
group-by:
- sourceIPAddress
timespan: 3d
condition:
gte: 2
field: sourceIPAddress
generate: true
level: high
---
title: Console Login Without MFA
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: signin.amazonaws.com
eventName: 'ConsoleLogin'
additionalEventData.MFAUsed: 'No'
condition: selection
level: medium |
temporaltitle: Correlation temporal Test
id: 49d15187-4203-4e11-8acd-8736f25b66xx
status: test
author: TEST
correlation:
type: temporal
rules:
- CloudTrail Log Settings Modified
- Console Login Without MFA
- Role Enumeration
timespan: 3d
generate: true
level: high
---
title: CloudTrail Log Settings Modified
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'cloudtrail.amazonaws.com'
eventName: 'UpdateTrail'
filter:
errorCode: 'AccessDenied'
condition: selection and not filter
level: high
---
title: Console Login Without MFA
author: Zach Mathis (@yamatosecurity)
date: 2025-04-13
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: signin.amazonaws.com
eventName: 'ConsoleLogin'
additionalEventData.MFAUsed: 'No'
condition: selection
level: medium
---
title: Role Enumeration
author: Zach Mathis (@yamatosecurity)
date: 2025-04-24
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'iam.amazonaws.com'
eventName: 'ListRoles'
condition: selection
falsepositives:
level: low |
temporal_orderedtitle: Correlation temporal_ordered Test
id: 49d15187-4203-4e11-8acd-8736f25b66xx
status: test
author: TEST
correlation:
type: temporal_ordered
rules:
- Console Login Without MFA
- Role Enumeration
- CloudTrail Log Settings Modified
timespan: 1d
generate: true
level: high
---
title: CloudTrail Log Settings Modified
author: Zach Mathis (@yamatosecurity)
date: 2025-04-23
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'cloudtrail.amazonaws.com'
eventName: 'UpdateTrail'
filter:
errorCode: 'AccessDenied'
condition: selection and not filter
level: high
---
title: Console Login Without MFA
author: Zach Mathis (@yamatosecurity)
date: 2025-04-13
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: signin.amazonaws.com
eventName: 'ConsoleLogin'
additionalEventData.MFAUsed: 'No'
condition: selection
level: medium
---
title: Role Enumeration
author: Zach Mathis (@yamatosecurity)
date: 2025-04-24
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'iam.amazonaws.com'
eventName: 'ListRoles'
condition: selection
falsepositives:
level: low |
YamatoSecurity
approved these changes
Jul 30, 2025
This was referenced Jul 30, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Changed
Limitation