Professional Security Operations Engineer

By Google · Question Mode

QuestionQ27

Detection engineering

You are responsible for identifying suspicious activity and security events across your organization's environment. You find that certain detection rules are triggering for internal IP addresses in the 192.0.2.0/8 subnet, causing false-positive alerts. You want to improve these detection rules. What should you add to the YARA-L detection rules?

Explanation

net.ip_in_range_cidr() returns true when an IP address is in the specified CIDR range. Applying any to the repeated principal.ip field makes the expression true if at least one principal IP is within that range; negating it prevents detections for events containing those internal IP addresses, reducing the false positives.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!