Generating tailored detection logic

It's great that we've identified a good search query to identify this type of malicious activity, but let's take that a step further to generate detection events in the Security app so that we aren't continually having to run a query in the Discover app.

Using what we learned in the Creating detection rules section of Chapter 8, The Elastic Security App, we can create a custom query detection rule to identify this activity:

Figure 9.16 – Tailored detection logic for an observed activity

In the preceding screenshot, we can see the completed detection rule that will generate an event when this activity is observed in the future:

Figure 9.17 – Tailored detection logic for an observed activity

In the preceding screenshot, we can see that the detection rule was triggered based on the persistence detection logic that we just created.

In this section, we created tailored detection logic based on the information...