Use Policies

• Lacework rules - Lacework provides a set of predefined Lacework rules that are visible from the Lacework Console. You can use the Lacework rules to suppress the generation of unwanted events in your environment. Lacework rules start with the LW_ prefix. For more information, see Disable Rules.
• Custom rules - You may want to create custom rules that check for unwanted behavior in your environment such as Telnet being used in your environment. You can also customize the triggers and severities for custom rules. Custom rules start with the CUSTOM_ prefix.

NOTE: This feature is immediately available, and you do not need to update your Lacework agents to use this functionality.

The Lacework and custom rules can be enabled or disabled. Lacework and custom rules are grouped in Policies. To view another set of rules, select a policy from the POLICY TYPE drop-down.

To find out if a rule can be cloned and therefore customized, expand the rule and look for the CLONE button. If the CLONE button does not appear, this rule cannot be cloned or this rule has already been cloned the maximum number of times (4 clones).

NOTE: Each rule has a default severity, but the actual event severity could be higher or lower based on different risk factors determined by the Lacework risk engine.

To create a custom rule:

1. Select MONITOR > Policies.
2. From the POLICY TYPE drop-down, select the rule type, such as Workload.
3. Expand the Rule and look for the CLONE button.
   • If the CLONE button displays, you can create a custom rule by clicking CLONE.
   • If the CLONE button does not appear, this rule cannot be cloned or this rule has already been cloned the maximum number of times (4 clones).
4. In the Event Name field, enter an appropriate title for the event generated when the rule fires because all the conditions are true.
5. Enter one or more AND conditions.
   When creating custom rules, note the following: 1) Lacework recommends limiting the number of conditions to three or less. 2) By design, Lacework captures the names of processes that engage in network activities. If you create a rule with a condition such as 'Executable path INCLUDE */whoami', the `whoami` usage is not captured and therefore, this condition is never true.
   • From the left drop-down select a parameter type such as Executable path.
   • From the middle drop-down select an operator type such as INCLUDE.
   • In the right field, enter a value for the operator to compare against the value in the specified parameter.
6. Select the rule Severity.
7. Toggle Enabled. When the trigger to run rules occurs, Lacework only runs those rules that are enabled. For more information, see Workload Rules and AWS Compliance Rules.

NOTE: You can also edit a custom rule directly from an event that was generated by the custom rule. From the timeline in MONITOR > Events, find the event generated from a custom rule. Click the Open Event Dossier icon and the Event details are displayed. In the top right corner, locate and click the Edit Rule icon to edit the custom rule that generated the event. Make any changes to the rule if desired and click Save.

String Type Behavior

When you specify a string in a condition, partial matches are not supported unless you specify the * wildcard, as shown by the following examples:

• If you specify the ‘Username INCLUDE sue’ condition and the current value of Username is suehunt, the condition is not true, the rule does not trigger or generate alerts.
• If you specify the ‘Username INCLUDE sue*’ condition (with the * wildcard) and the current value of Username is suehunt, the condition is true, the rule triggers and generates alerts.

You can specify multiple possible matches using a comma-separated list. For example, If you specify the ‘Username INCLUDE suehunt,joesmith’ condition and the current value of Username is suehunt or joesmith, the condition is true, the rule triggers and generates alerts.

Disable Rules to Suppress Events

You can optionally disable rules if some rules do not apply to your environment. For example, if you use third-party MFA (Multi-Factor Authentication) tool instead of AWS MFA, the Successful Console Login Without MFA rule generates events for every AWS login. You can disable the Successful Console Login Without MFA rule to suppress this rule from generating alerts.

To disable a rule:

1. Select MONITOR > Policies.
2. From the POLICY TYPE drop-down, select the rule type, such as Workload.
3. Find and expand the rule to disable.
4. Toggle to Disabled.

Workload Rules

The table below specifies the predefined Workload rules.

If Lacework detects that a process or application has run, Lacework evaluates all the enabled Lacework and custom Workload rules. During this rule evaluation, Lacework checks if all the conditions in a Workload rule evaluate to true and if they do, an event is generated that is visible from the Lacework Console. This rule evaluation is repeated for each enabled rule.

If the same rule triggers again within the next hour, the existing event is updated with summary information about what triggered the subsequent trigger. After one hour if the same rule triggers again, another event is created.

In addition to the Lacework and custom rules, Lacework has a set of internal conditions that also generate Workload events that are visible from the Lacework console, for example, if a file with a suspicious hash is found a Malicious File event is generated. These internal detections and event generation occur concurrently with the detection and event generation done by the custom and Lacework rules.

Parameters for the Application Rules (Prefix: LW_APP)

Parameters for the File Integrity Monitoring (FIM) Rules (Prefix: LW_FIM)

Parameters for the User Login Activity Rules (Prefix: LW_USER)

AWS Compliance Rules

The table below specifies the predefined AWS Compliance Lacework rules.

Lacework generates the data needed to populate the AWS compliance reports on a regular schedule, typically once a day. After the report data is generated, Lacework evaluates all the enabled AWS compliance rules. During this rule evaluation, Lacework checks if all the conditions in an AWS compliance rule evaluate to true and if they do, an event is generated. This rule evaluation is repeated for each enabled rule.

If the same rule triggers again within the next hour, the existing event is updated with summary information about what triggered the subsequent trigger. After one hour if the same rule triggers again, another event is created.