Threat Detection using CRS

CRS primarily relies on process and network events to enable effective threat detection. By analyzing runtime activity such as process execution and network connections, CRS helps security teams identify suspicious behavior, reduce false positives, and perform post-incident analysis.
This topic provides practical use cases and configuration recipes to help you implement threat detection effectively.

Prerequisites for Threat Detection

• CRS Deployment: Ensure CRS sensors are deployed, running, and connected to Qualys Enterprise TruRisk™ Platform.
• Runtime Policies: Configure network policies to monitor network activity based on threats.
• Process Allow List: Keep processAllowList.enabled=true and define required processes.

Best Practices for Threat Detection

• The process allowlist should be concise as provided in the Helm chart README 
• The network policy should be rate limit-enabled. Refer to the example network policy to be applied. 

Applying Network Policies using mini-CRD

CRS captures TCP Connect requests and generates events when policy is applied.

Here is a sample mini-CRD policy that monitors TCP open connection requests and skips events with destinations in the IP range specified in the YAML below. 

apiVersion: qualys.com/v1
kind: RuntimePolicy
metadata:
  name: net-policy-tcp-open
spec:
  base-policy: net-tcp-open
  action: audit
  skip-dest-ips:
    - "10.0.0.0/8"
    - "172.16.0.0/12"
    - "192.168.0.0/16"
    - "127.0.0.0/8"

Advanced Filtering Options 

Apart from the skip-dest-ips CRS offers the following kinds of filters.  

• IP based
  • monitor-dest-ips: Monitor the given destination IP addresses.
  • monitor-src-ips: Monitor the given Source IP addresses.
  • skip-src-ips: Skip the given destination IP addresses.
• Port Based
  • monitor-dest-ports: Monitor the given destination ports 
  • monitor-src-ports: Monitor the given Source ports
  • skip-dest-ports: Skip the given destination ports
  • skip-src-ports: Skip the given source ports

- IP addresses can be given either IP like - '192.168.11.1' or IP range in CIDR format - '192.168.1.1/16'
- Port addresses can be given as string - '344'.
- Currently IP addresses only in the form of numbers are supported.
- FQDN and IPv6 are not supported.