refactor(sonicwall): revamp filter and correlation rules

Rebuild the SonicWall filter so the parsed events use clear, human-readable
field names and match the fields their correlation rules actually consume.
Refresh the seven remaining rules so they fire on the real fields the
filter emits, and drop three rules that no longer made sense as security
signals for this integration.

Filter changes (filters/sonicwall/sonic_wall.yml):
- Emit clean origin.ip / target.ip (no port or interface glued on)
- Emit protocol as tcp/udp only, keep the service hint separately
- Emit action / actionResult without leftover quotes
- Rescue the full text of quoted fields (message, note, category, rule,
  session type, VPN policy, user, uuid, action, appName, device time)
  so they are no longer truncated at the first space
- Rename cryptic vendor tokens (m, n, sn, sess, usr, gcat, pri, dpi,
  ipscat, cs6, ...) to self-explanatory names like log.eventCode,
  log.deviceSerial, log.sessionType, log.groupCategory
- Keep both syslog KV and syslog CEF supported

Rules changes (rules/sonicwall/sonicwall_firewall/):
- Refresh 7 rules to use the new field names
- Remove 3 rules that did not belong to this integration or fired on
  benign traffic (Capture Client, Encrypted Threats, Zero-Day)

Validated against live traffic on env 10.11.11.129.

Author: JocLRojas

filters/sonicwall/sonic_wall.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,23 +14,26 @@ references:
   - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
   - https://attack.mitre.org/techniques/T1082/
 description: |
-  Detects when SonicWall Anti-Spyware service identifies and blocks spyware, adware, or other potentially unwanted programs (PUPs) that may be attempting to collect sensitive information or establish persistence on the network.
+  Detects when SonicWall Anti-Spyware service identifies and blocks spyware,
+  adware or other potentially unwanted programs (PUPs) that may be attempting
+  to collect sensitive information or establish persistence on the network.
 
   Next Steps:
-  - Review the detected spyware category and priority level
-  - Investigate the source IP address for other malicious activities
-  - Check if the blocked spyware represents a targeted attack or widespread infection
-  - Verify that Anti-Spyware policies are properly configured and up-to-date
-  - Consider quarantining the affected host if multiple spyware detections occur
-  - Review network traffic patterns from the source to identify potential data exfiltration
+  - Review the detected spyware category and priority level.
+  - Investigate the source IP for other malicious activities.
+  - Check whether the blocked spyware represents a targeted attack or a
+    widespread infection.
+  - Verify Anti-Spyware policies are properly configured and signatures
+    up-to-date.
+  - Consider quarantining the affected host if multiple detections cluster
+    on the same source.
 where: |
-  (exists("log.spycat") || 
-   contains("log.message", "spyware") ||
-   contains("log.message", "Anti-Spyware") ||
-   contains("log.eventName", "Anti-Spyware") ||
-   contains("log.category", "Anti-Spyware") ||
-   (exists("log.spypri") && !equals("log.spypri", "0"))) &&
-  (equals("action", "blocked") || equals("log.fw_action", "drop"))
+  (
+    oneOf("log.eventCode", ["1157", "1158", "1159"]) ||
+    exists("log.spywareCategory") ||
+    contains("log.message", ["spyware", "Anti-Spyware"]) ||
+    contains("log.contentCategory", "Anti-Spyware")
+  ) && equals("actionResult", "denied")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:

rules/sonicwall/sonicwall_firewall/anti_spyware_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,25 +14,30 @@ references:
   - https://www.sonicwall.com/support/knowledge-base/understanding-geo-ip-and-botnet-filter-diagnostics-options/200527122256150
   - https://attack.mitre.org/techniques/T1071/
 description: |
-  Detects potential botnet command and control (C2) communication or infected host behavior identified by SonicWall's botnet filter. This includes suspicious outbound connections, HTML infection chains, or known botnet signatures.
+  Detects potential botnet command and control (C2) communication identified
+  by the SonicWall Botnet Filter. Includes matches against SonicWall's Botnet
+  Filter signature codes and message text indicating known botnet endpoints.
 
   Next Steps:
-  1. Investigate the source IP for additional suspicious activity
-  2. Check network logs for other connections from the same host
-  3. Analyze DNS queries from the affected host
-  4. Review endpoint logs for signs of malware infection
-  5. Consider isolating the affected host if infection is confirmed
-  6. Update threat intelligence feeds and security signatures
-  7. Scan the host with updated antivirus/anti-malware tools
-where: (equals("log.category", "Botnet") || contains("log.message", "botnet") || contains("log.message", "infected") || contains("log.message", "C&C") || contains("log.message", "command and control") || equals("log.af_service", "botnet")) && (equals("action", "blocked") || equals("action", "dropped") || equals("log.fw_action", "drop"))
+  1. Investigate the source IP for other suspicious behavior (DNS, beaconing).
+  2. Check endpoint logs on the internal host for signs of infection.
+  3. Isolate the affected host if infection is confirmed.
+  4. Update threat intel feeds and blocklists with the observed C2 endpoint.
+where: |
+  (
+    oneOf("log.eventCode", ["1370", "1371"]) ||
+    equals("log.appFirewallService", "botnet") ||
+    contains("log.message", ["botnet", "Botnet", "infected", "C&C", "command and control"]) ||
+    contains("log.contentCategory", "Botnet")
+  ) && equals("actionResult", "denied")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:
       - field: origin.ip
         operator: filter_term
         value: '{{.origin.ip}}'
     within: 2h
-    count: 10
+    count: 5
 groupBy:
   - adversary.ip
   - target.ip

rules/sonicwall/sonicwall_firewall/botnet_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,24 +14,37 @@ references:
   - https://www.sonicwall.com/support/knowledge-base/capture-atp-overview/170503785055490
   - https://attack.mitre.org/techniques/T1204/
 description: |
-  Detects when SonicWall Capture ATP (Advanced Threat Protection) identifies a file as malicious after sandbox analysis. This indicates an attempted malware delivery or execution that was blocked by the ATP service.
+  Detects when SonicWall Capture ATP (Advanced Threat Protection) sandboxes a
+  file and returns a malicious verdict. Indicates an attempted malware
+  delivery. Also covers RTDMI (Real-Time Deep Memory Inspection) verdicts
+  which share the ATP verdict pipeline on the firewall.
 
   Next Steps:
-  1. Investigate the source IP address for additional malicious activity
-  2. Review the file hash and name for threat intelligence correlation
-  3. Check if the same file was delivered to other internal systems
-  4. Verify ATP policies are properly configured and up to date
-  5. Consider blocking the source IP at the perimeter if confirmed malicious
-  6. Document the incident and update threat intelligence feeds
-where: (contains("log.msg", "Capture ATP") || contains("log.msg", "Gateway Anti-Virus") || contains("log.msg", "Sandbox") || equals("log.category", "Anti-Virus") || equals("log.af_type", "ATP")) && (contains("log.msg", "malicious") || contains("log.msg", "blocked") || contains("log.msg", "threat detected") || equals("log.result", "malicious") || equals("action", "blocked"))
+  1. Investigate the source IP for additional malicious activity.
+  2. Pivot on the file hash / URL captured in `log.note` against threat intel.
+  3. Check whether the same file reached other internal systems.
+  4. Verify ATP policies and enforce automated blocking if not already set.
+where: |
+  (
+    oneOf("log.eventCode", ["1440", "1441"]) ||
+    equals("log.appFirewallType", "ATP") ||
+    contains("log.message", ["Capture ATP", "Sandbox", "RTDMI"]) ||
+    contains("log.note", ["Capture ATP", "malicious verdict", "ATP verdict"])
+  ) &&
+  (
+    equals("log.threatResult", "malicious") ||
+    contains("log.message", ["malicious", "threat"]) ||
+    contains("log.note", ["malicious", "threat"]) ||
+    equals("actionResult", "denied")
+  )
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:
       - field: origin.ip
         operator: filter_term
         value: '{{.origin.ip}}'
     within: 1h
-    count: 2
+    count: 1
 groupBy:
   - adversary.host
   - adversary.ip

rules/sonicwall/sonicwall_firewall/capture_atp_verdicts.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,23 +14,22 @@ references:
   - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
   - https://attack.mitre.org/techniques/T1105/
 description: |
-  Detects when SonicWall Gateway Anti-Virus (GAV) identifies and blocks malicious content. This indicates potential malware attempting to enter the network through web traffic, email attachments, or file downloads. The Gateway Anti-Virus service scans HTTP, HTTPS, FTP, and SMTP traffic in real-time to detect and prevent malware from entering the network perimeter.
+  Detects when SonicWall Gateway Anti-Virus (GAV) identifies and blocks
+  malicious content in HTTP/HTTPS/FTP/SMTP traffic. Signals a malware delivery
+  attempt at the network perimeter.
 
   Next Steps:
-  1. Review the specific malware signature or threat name in the log details
-  2. Investigate the source IP address and geolocation for suspicious patterns
-  3. Check if the same source has attempted other malicious activities
-  4. Verify that the anti-virus definitions are up to date
-  5. Consider implementing additional network segmentation if internal hosts are affected
-  6. Review firewall policies to ensure proper traffic filtering
-  7. Escalate to incident response team if part of a coordinated attack campaign
+  1. Review the malware name/signature carried in `log.message` / `log.note`.
+  2. Investigate the source IP and geolocation for correlated attempts.
+  3. Confirm the AV definitions are current on the firewall.
+  4. Escalate to incident response if the activity is part of a broader
+     campaign against the tenant.
 where: |
-  (contains("log.gcat", "Gateway Anti-Virus") || 
-   contains("log.message", "virus") || 
-   contains("log.message", "malware") ||
-   contains("log.eventName", "Anti-Virus") ||
-   contains("log.category", "Anti-Virus")) &&
-  equals("action", "blocked")
+  (
+    oneOf("log.eventCode", ["79", "608", "609", "1122"]) ||
+    (equals("log.groupCategory", "Security Services") && contains("log.message", ["virus", "malware", "Anti-Virus"])) ||
+    contains("log.contentCategory", "Anti-Virus")
+  ) && equals("actionResult", "denied")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:

rules/sonicwall/sonicwall_firewall/capture_client_threats.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,23 +14,27 @@ references:
   - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
   - https://attack.mitre.org/techniques/T1190/
 description: |
-  Detects when SonicWall IPS identifies and blocks intrusion attempts, including buffer overflows, SQL injection, cross-site scripting, and other network-based attacks targeting vulnerabilities. This rule triggers when the SonicWall firewall's Intrusion Prevention System detects malicious traffic patterns or known attack signatures.
+  Detects when SonicWall Intrusion Prevention System (IPS) blocks an attack
+  matching a known signature — buffer overflow attempts, SQL injection,
+  cross-site scripting, exploit kits, etc. Reflects the IPS Prevention Alert
+  message family (event codes 88 / 89 / 100 / 785) as well as the descriptive
+  `log.message`, `log.contentCategory` and `log.ipsCategory` fields.
 
   Next Steps:
-  1. Verify the blocked attack by reviewing the SonicWall logs for attack details and signatures matched
-  2. Check if the attack was successfully blocked or if any traffic bypassed the IPS
-  3. Investigate the source IP for additional malicious activity or patterns
-  4. Review target systems for any signs of compromise if the attack was not fully blocked
-  5. Update IPS signatures if new attack patterns are discovered
-  6. Consider implementing additional network segmentation if attacks are targeting critical systems
-  7. Review and update security policies if necessary to prevent similar attacks
+  1. Review the matched signature and CVE (if any) in `log.message` / `log.note`.
+  2. Confirm the block succeeded — check for follow-up connections from the
+     same source that bypassed IPS.
+  3. Investigate the target for compromise signs if the signature was severity
+     high/critical.
+  4. Update IPS profile if the target service is not supposed to expose that
+     surface.
 where: |
-  (exists("log.ipscat") || 
-   contains("log.message", "IPS") ||
-   contains("log.eventName", "Intrusion") ||
-   contains("log.category", "Intrusion Prevention") ||
-   (exists("log.ipspri") && !equals("log.ipspri", "0"))) &&
-  (equals("action", "blocked") || equals("log.fw_action", "drop"))
+  (
+    oneOf("log.eventCode", ["88", "89", "100", "785"]) ||
+    exists("log.ipsCategory") ||
+    contains("log.message", ["IPS Detection Alert", "IPS Prevention Alert", "Intrusion"]) ||
+    contains("log.contentCategory", "Intrusion Prevention")
+  ) && equals("actionResult", "denied")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:

rules/sonicwall/sonicwall_firewall/encrypted_threats_detection.yml

@@ -1,4 +1,4 @@
-# Rule version v1.0.0
+# Rule version v2.1.0
 
 dataTypes:
   - firewall-sonicwall
@@ -14,29 +14,32 @@ references:
   - https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
   - https://attack.mitre.org/techniques/T1110/
 description: |
-  Detects multiple failed authentication attempts to the SonicWall management interface, indicating potential brute force attacks against administrative credentials.
+  Detects failed authentication attempts against the SonicWall management
+  interface (GUI/CLI/API). Repeated failures from a single source IP suggest
+  a brute-force or credential-stuffing attack targeting admin credentials.
 
   Next Steps:
-  1. Investigate the source IP address attempting authentication
-  2. Check if the source IP is from an authorized management network
-  3. Review for successful logins from the same IP after failures
-  4. Consider blocking the source IP on the management interface
-  5. Restrict management access to specific IP addresses
-  6. Enable account lockout and two-factor authentication
+  1. Investigate the source IP — geolocation, reputation, previous activity.
+  2. Confirm the source is NOT from an authorized management network.
+  3. Search for a successful admin login from the same IP AFTER the failures
+     (indicator of a successful brute force).
+  4. Restrict management access to specific IP ranges and enforce MFA.
 where: |
-  ((contains("log.message", ["admin", "management", "login"]) &&
-    contains("log.message", ["fail", "denied", "invalid", "incorrect"])) ||
-   contains("log.eventName", ["Administrator login failed", "Login failure"]) ||
-   contains("log.category", "Authentication Access")) &&
-  exists("origin.ip")
+  (
+    oneOf("log.eventCode", ["29", "32", "33", "1246"]) ||
+    (
+      contains("log.message", ["admin", "administrator", "login", "management"]) &&
+      contains("log.message", ["failed", "fail", "denied", "invalid", "incorrect"])
+    )
+  ) && exists("origin.ip")
 afterEvents:
   - indexPattern: v11-log-firewall-sonicwall-*
     with:
       - field: origin.ip
         operator: filter_term
         value: '{{.origin.ip}}'
     within: 15m
-    count: 10
+    count: 5
 groupBy:
   - adversary.ip
   - adversary.user