Sigma Extension

Support
1

Hello, I am having an issue with one customer organization where Sigma rules are not updating. I think this might be a permissions issue but not sure how to resolve this.

2

Any errors in the Platform Errors section?
Can you send us the OID?

3

Hello, I do not see any errors in the platform logs. I have also noticed I am unable to disable any sigma rules because I do not have the dr.set.replicant permission. This permission is not listed as an available permission for my user.
I will send you the OID in a PM.

4

Ok, it looks like the sync rule (named “ext-ext-sigma-update”) was removed at some point in that org. It should be in the “dr-managed” Hive.

I tried to look at our logs to see when it happened but couldn’t find it so it might have been removed a long time ago.

The fix should be simple:

  1. Unsubscribe from ext-sigma
  2. Wait 1 minute (to make sure there’s nothing left at all from the old instance, there’s a lot of rules that get removed)
  3. Resubscribe to ext-sigma

In theory you could re-create the rule but it’s going to be more of a pain than the subscription approach.

1 Like
5

Hello,
I have unsubscribed and subscribed again and now I am seeing all of the rules. I also now see the “ext-sigma-update” rule.

I am unable to disable a sigma rule. When I try I receive the message “Not allowed, missing dr.set.replicant permission”. This permission is not listed as an available permission under my user.

Also, the Sigma extension lists the following granted permissions. I do not see the dr.del.replicant or the dr.list.prelicant permissions under my user either.
dr.del.replicant
dr.list.replicant
dr.set.replicant
org.get
dr.del.managed
dr.list.managed
dr.set.managed

6

That permission is not expected to ever be given to a user, that is how we protect some of the automation rules.

I suspect this may actually be a bug in the web app where it’s trying to update the rule, by disabling it, in a way that it requires the full permission. But in theory you should be able to do it with the metadata permission which you should have. I will try to replicate a little bit later to confirm.

1 Like
7

In the GUI I can disable a Sigma rule from the D&R Rules page. Where I see the error is if you click into a Sigma rule, then disable the rule and try to click the Update button.

8

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.