RMM tools by user

Model rmm

Rarity model of which LOLRMM tools each user runs, so a tool new to a user stands out. Needs Sysmon process events with a user field.

Part of: Remote management tool hunting
Requires: LOLRMM tools
Required by: Remote Management Tool Rare for the User, Remote Management Tools

Add it

In Bifract, open Exchange, find RMM tools by user and click Add. Adds an analytics model to the fractal. It builds from new logs; run a backfill under Analytics for stored ones. Needs an analyst.

File

exchange/models/rmm_users.yaml

rmm_users.yaml

name: rmm_users
description: >-
  How often each user runs each remote monitoring and management tool from the LOLRMM
  list, so a tool new to a user, or rare for them, stands out.
model_type: rarity
definition:
  partition_key: user
  value_key: Name
  min_sample: 1
  alert:
    severity: medium
    coverage_threshold: 0.8
    percent_threshold: 5
    alert_on_new: true
    z_threshold: 3.5
  source_bql: |-
    event_id=1
    | match(dict=lolrmm, field=image, column=InstallationPaths, include=[Name], require=true)