[Rule Tuning] RPC (Remote Procedure Call) to the Internet (32923416-763a-4531-bb35-f33b9232ecdb)

[tradebot-elastic]

Rule Tuning Analysis

Rule ID: 32923416-763a-4531-bb35-f33b9232ecdb
Rule Name: RPC (Remote Procedure Call) to the Internet
Rule Type: query

---

Classification

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	61.36
Version Status	✅ Established (24 release cycles)

---

Alert Telemetry

Metric	Value
Total Alerts (3d)	29,846
Unique Clusters	25
Cluster Coverage	1.0%
Daily Average	9949
Days Active	3
Coefficient of Variation	0.60 (MODERATE)

---

Analysis Flags

• 🔴 Noisy on Latest Version: ✅ Yes
• 🔴 Widespread False Positive: ❌ No
• ⚠️ Version Regression: ❌ No
• ⚠️ Stale and Noisy: ❌ No
• ⚠️ Low Version / High Volume: ❌ No
• ℹ️ Low Activity: ❌ No

---

Recommendation

Action: Add KQL exclusions for PAN-OS incomplete flows, dropped/timeout actions, and a low-packet threshold to suppress handshake/scan noise while keeping established RPC to Internet.

Rationale: The rule is firing heavily on PAN-OS network flow logs showing TCP/135 attempts that never fully establish (network.application: "incomplete") and very low packet/byte volumes. This broad condition (any RFC1918 host to external TCP/135 or zeek.dce_rpc) captures transient/failed handshakes and dropped flows, creating substantial noise. Tightening the query to exclude incomplete/dropped flows and very low-packet traffic preserves real RPC exposure while reducing scan/handshake noise.

Query Modifications

PAN-OS incomplete application classification floods alerts with failed handshakes. (Impact: both)

Current:

(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) ...

Modify →

and not (event.dataset:panw.panos and network.application:"incomplete")

Failed handshakes/scans are classified as "incomplete"; excluding them focuses detection on established RPC sessions or traffic recognized by Zeek DCE/RPC.

Dropped/timeout flows generate noise and do not represent real exposure. (Impact: both)

Current:

No action-based filtering; includes flow_dropped/timeout.

Modify →

and not event.action:(flow_dropped or timeout)

Removes flows not successfully permitted through the firewall, aligning detection with actual RPC exposure.

Single-packet/very low-volume flows (typical scans) inflate alerts. (Impact: both)

Current:

No traffic volume threshold; 1–2 packet flows match equally.

Modify →

and not (event.dataset:panw.panos and network.packets <= 2)

Requires more than a couple of packets in PAN-OS flows, reducing SYN-only or brief attempts while retaining real RPC communication.

Exception Recommendations

Add exception: network.application is "incomplete" (Confidence: HIGH)

All 5 sample alerts show network.application: "incomplete" with 1–2 packets and 62/132 bytes, indicating failed handshakes or scans. Field diversity is dominated by PAN-OS flows, and this pattern is a common benign noise source in firewall telemetry.

Modify →

and network.application is "incomplete"

Add exception: event.action is one of "flow_dropped, timeout" (Confidence: MEDIUM)

Field diversity shows significant presence of flow_dropped and timeout. These are not established connections and should be excluded to focus on successful RPC exposure.

Modify →

and event.action is one of "flow_dropped, timeout"

Field-Level Recommendations

Field	Value	Alert %	Cluster %	Confidence	Type
network.application	incomplete	0.0%	70.0%	HIGH	EXCEPTION
event.action	flow_dropped, timeout	0.0%	40.0%	MEDIUM	EXCEPTION
user.domain	itsyork	181357.1%	0.0%	LOW	CUSTOMER_SPECIFIC
event.dataset	panw.panos	141156.7%	0.9%	LOW	CUSTOMER_SPECIFIC
user.domain	redlobster	126171.4%	0.0%	LOW	CUSTOMER_SPECIFIC

---

This issue was generated by the GenAI Tradecraft Rule Tuning Advisor.
Analysis timestamp: 2025-12-18T06:09:24.872046

[tradebot-elastic]

Updated Analysis - 2025-12-26

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	60.89
Version Status	✅ Established (24 release cycles)

Key Changes

• Daily Average: 7564
• Cluster Coverage: 1.1%
• CV: 0.50

Recommendation: Add a KQL exclusion for PAN-OS flows with network.application:"incomplete" and prefer msrpc/dce_rpc-classified traffic.

Rationale: The rule is overly broad by keying on destination.port 135 without validating true RPC traffic. Most sample alerts come from PAN-OS flows classified as network.application 'incomplete' with minimal bytes/packets, indicating scans or failed handshakes rather than real RPC sessions. Tightening the query to exclude PAN-OS 'incomplete' application and to prefer msrpc/dce_rpc-classified flows will cut large volumes of benign noise while preserving detection of actual RPC to the Internet.

Query Modifications

High alert volume from PAN-OS flows labeled as incomplete (failed handshake/scans). (Impact: both)

Modify →

(network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc)) and not (event.dataset:panw.panos and network.application:"incomplete")

Port-only matching includes non-RPC traffic; prefer protocol/app identification. (Impact: accuracy)

Modify →

((destination.port:135 and network.application:("msrpc-base" or "msrpc*" or "dcerpc*")) or event.dataset:zeek.dce_rpc)

Exception Recommendations

Add exception: network.application is "incomplete"

Modify →

and network.application is "incomplete"

Add exception: destination.as.organization.name is "CISCO-UMBRELLA"

Modify →

and destination.as.organization.name is "CISCO-UMBRELLA"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-01-02

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	60.68
Version Status	✅ Established (25 release cycles)

Key Changes

• Daily Average: 5305
• Cluster Coverage: 1.0%
• CV: 0.48

Recommendation: Constrain the rule to recognized RPC (Zeek DCE/RPC or PAN msrpc*) or minimally established TCP/135 flows and exclude PAN-OS 'incomplete' application traffic.

Rationale: The rule is overly broad by alerting on any TCP/135 traffic from RFC1918 space, which produces large noise from PAN-OS 'incomplete' flows and low-packet/zero-byte connection attempts (likely probes or failed handshakes). Sample events show repeated incomplete application classification and minimal traffic, with occasional legitimate msrpc-base sessions. Tightening the query to require recognized RPC (Zeek DCE/RPC or PAN msrpc*) or a minimal packet/byte threshold and excluding 'incomplete' will materially reduce noise while preserving detection of true RPC exposure.

Query Modifications

Alerts triggered by PAN-OS "incomplete" application classification (failed or partial sessions) dominate noise. (Impact: both)

Modify →

network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and not network.application:incomplete

Port-only logic produces alerts for single-packet/zero-byte probes that are not meaningful RPC exposure. (Impact: accuracy)

Modify →

(event.dataset:zeek.dce_rpc or network.application:msrpc* or (destination.port:135 and network.packets >= 3 and destination.bytes > 0))

Exception Recommendations

Add exception: network.application is "incomplete"

Modify →

and network.application is "incomplete"

Add exception: destination.as.organization.name is one of "CISCO-UMBRELLA, ATT-INTERNET4"

Modify →

and destination.as.organization.name is one of "CISCO-UMBRELLA, ATT-INTERNET4"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-01-13

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	60.86
Version Status	✅ Established (25 release cycles)

Key Changes

• Daily Average: 9149
• Cluster Coverage: 1.0%
• CV: 0.65

Recommendation: Exclude PAN-OS 'incomplete' application flows and known scanner policies (e.g., InfoBlox) while retaining positive RPC identification.

Rationale: The rule is over-alerting primarily on PAN-OS flows that are port-135 hits classified as 'incomplete' (scanner/SYN noise) and on known vulnerability/asset scanners (e.g., InfoBlox). Evidence shows repeated PAN-OS application 'incomplete' and scanner firewall policies, while legitimate RPC is typically classified 'msrpc-base' or appears in zeek.dce_rpc. Add targeted exclusions for incomplete application traffic and scanner policies, and tighten the port-only logic to prefer positive RPC identification.

Query Modifications

Port-only matching (destination.port:135) allows many non-RPC or unclassified SYN/scan flows. (Impact: both)

Modify →

network.transport:tcp and ((event.dataset:zeek.dce_rpc) or (event.module:panw and network.application: "msrpc-base") or (destination.port:135 and not network.application: "incomplete" and network.packets >= 3))

Scanner flows create large volumes from PAN-OS datasets. (Impact: performance)

Modify →

(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and not (event.module: panw and rule.name: *InfoBlox*)

Handshake-only connections inflate alerts with minimal context. (Impact: accuracy)

Modify →

network.packets >= 3 and network.bytes > 0

Exception Recommendations

Add exception: network.application is "incomplete"

Modify →

and network.application is "incomplete"

Add exception: rule.name matches "*InfoBlox*"

Modify →

and rule.name matches "*InfoBlox*"

Add exception: rule.name is "Internal to PublicDMZ"

Modify →

and rule.name is "Internal to PublicDMZ"

Add exception: source.user.name is one of "scelasticsynmonitor,svc-adfssa"

Modify →

and source.user.name is one of "scelasticsynmonitor,svc-adfssa"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-01-20

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	61.02
Version Status	✅ Established (26 release cycles)

Key Changes

• Daily Average: 8716
• Cluster Coverage: 1.2%
• CV: 0.63

Recommendation: Constrain detections to positively-identified RPC (msrpc/dce_rpc) or minimally substantive flows and add a PAN-OS-specific exclusion for application "incomplete".

Rationale: The rule is over-broad by alerting on any outbound TCP/135 from private IPs, which in PAN-OS logs frequently appears as application=incomplete (short, failed handshakes/scans) and corporate policy-allowed flows to DMZ/VPN. Evidence shows repeated incomplete App-ID and firewall policy names driving most alerts. Tighten to positively-identified RPC (msrpc/dce_rpc) or minimally substantive flows and exclude PAN-OS incomplete to reduce noise while preserving true Internet-exposed RPC.

Query Modifications

Port-only match includes scans/short attempts and non-RPC traffic to 135. (Impact: both)

Modify →

network.transport:tcp and (
  event.dataset:zeek.dce_rpc or
  network.application:("msrpc" or "msrpc-base") or
  (destination.port:135 and network.packets >= 4)
)
and not (event.module: "panw" and network.application: "incomplete")

Exception Recommendations

Add exception: network.application is "incomplete"

Modify →

and network.application is "incomplete"

Add exception: rule.name is one of "Internal to PublicDMZ,policy-gp-to-lan,Inside-to-Outside"

Modify →

and rule.name is one of "Internal to PublicDMZ,policy-gp-to-lan,Inside-to-Outside"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-01-28

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	61.69
Version Status	✅ Established (27 release cycles)

Key Changes

• Daily Average: 12854
• Cluster Coverage: 1.1%
• CV: 0.56

Recommendation: Restrict matches to confirmed RPC or TCP/135 sessions with a minimal handshake and exclude PAN‑OS 'incomplete' app-id traffic.

Rationale: The rule is overly broad for PAN-OS/flow data by alerting on any TCP/135 to public IPs, including 1‑packet ‘incomplete’ sessions that aren’t proven RPC. Evidence shows repeated PAN-OS application=incomplete (1 packet, 70 bytes) and traffic to benign providers (e.g., OpenDNS) or an organization’s own public DMZ, driving high alert volume. Tightening to require a minimal handshake and/or positive RPC app identification will preserve detection while removing common noise.

Query Modifications

Broad matching on TCP/135 includes single-packet, non-established sessions and non-RPC traffic (e.g., PAN-OS 'incomplete'). (Impact: accuracy)

Modify →

network.transport: tcp and (event.dataset: zeek.dce_rpc or network.application: ("msrpc-base") or (destination.port: 135 and network.packets >= 3 and not network.application: ("incomplete" or "unknown-tcp")))

Single-packet flows inflate volume with negligible investigative value. (Impact: accuracy)

Modify →

(destination.port: 135 and network.packets >= 3) or event.dataset: zeek.dce_rpc or network.application: ("msrpc-base")

Exception Recommendations

Add exception: destination.as.organization.name is "Cisco OpenDNS, LLC"

Modify →

and destination.as.organization.name is "Cisco OpenDNS, LLC"

Add exception: destination.as.organization.name is "Red Lobster"

Modify →

and destination.as.organization.name is "Red Lobster"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-02-04

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	61.55
Version Status	✅ Established (27 release cycles)

Key Changes

• Daily Average: 11097
• Cluster Coverage: 0.9%
• CV: 0.39

Recommendation: Exclude PAN-OS single-packet 'incomplete' flows by adding: and not (event.dataset:"panw.panos" and network.application:"incomplete" and network.packets <= 2).

Rationale: The rule flags internal-to-external TCP 135 (RPC) traffic across network sources, but most alerts are PAN-OS flows classified as 'incomplete' with 1 packet (likely SYN probes/NAT hairpins), plus traffic to an organization’s own public DMZ. Adding a targeted PAN-OS filter to drop single-packet 'incomplete' flows and tightening the dataset/category logic will substantially reduce noise while preserving true RPC to Internet detections.

Query Modifications

High volume from PAN-OS single-packet 'incomplete' classifications to port 135 (likely SYN probes or NAT hairpins). (Impact: both)

Modify →

network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and not (event.dataset:"panw.panos" and network.application:"incomplete" and network.packets <= 2)

Broad dataset/category clause increases match scope and cost. (Impact: performance)

Modify →

event.category: network

Some logs include connection end markers; constraining to connection events reduces non-connection noise. (Impact: both)

Modify →

event.type: connection

Exception Recommendations

Add exception: destination.as.organization.name is "Red Lobster"

Modify →

and destination.as.organization.name is "Red Lobster"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-02-11

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	61.49
Version Status	✅ Established (28 release cycles)

Key Changes

• Daily Average: 12024
• Cluster Coverage: 1.1%
• CV: 0.52

Recommendation: Tighten the KQL to require confirmed RPC identification for PAN-OS (e.g., network.application: msrpc-base) while keeping Zeek DCE/RPC signals and non-PAN port-135 visibility, then add small, environment-specific allowlists for known destination IPs/policies that are repeatedly triggering.

Rationale: The rule is extremely noisy in a small set of environments (36k alerts/3d across 31 clusters) largely because it alerts on any TCP/135 egress from RFC1918 space to any non-RFC1918 destination, including PAN-OS flows where App-ID is incomplete (often short/low-context connections) and common “internal-to-own-public-space” routing/NAT scenarios (e.g., repeated destination IPs in the samples). Tuning should primarily tighten PAN-OS matching to confirmed RPC App-IDs (while keeping Zeek DCE/RPC coverage) and then allowlist known business-justified external RPC endpoints per environment.

Query Modifications

Port-only matching on PAN-OS generates high volumes of low-fidelity hits when App-ID is incomplete (seen in 3/5 provided PAN-OS samples), inflating noise. (Impact: accuracy)

Modify →

(event.dataset:zeek.dce_rpc) or (destination.port:135 and (
  (not event.dataset:panw.panos) or
  (event.dataset:panw.panos and network.application:msrpc-base)
))

Broad dataset/category clause can pull in heterogeneous network logs; tightening the dataset set can reduce unnecessary evaluation and improve selectivity. (Impact: performance)

Modify →

(event.dataset:(panw.panos or zeek.dce_rpc or network_traffic.flow) or event.category:network)

Exception Recommendations

Add exception: destination.ip is one of "129.67.10.245, 156.26.1.114, 8.43.64.124"

Modify →

and destination.ip is one of "129.67.10.245, 156.26.1.114, 8.43.64.124"

Add exception: rule.name is one of "VPN to Internet, Internal to PublicDMZ, policy-gp-to-lan"

Modify →

and rule.name is one of "VPN to Internet, Internal to PublicDMZ, policy-gp-to-lan"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-02-19

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	61.04
Version Status	✅ Established (28 release cycles)

Key Changes

• Daily Average: 10105
• Cluster Coverage: 0.6%
• CV: 0.53

Recommendation: Modify the KQL to suppress PAN-OS TCP/135 alerts when the session is network.application: incomplete and effectively empty (1 packet / 0–100 bytes), while keeping true RPC identifications (e.g., PAN-OS msrpc-base or Zeek zeek.dce_rpc).

Rationale: This rule is generating very high alert volume in a small set of clusters, largely driven by PAN-OS flow logs where destination port 135 is present but the Palo Alto App-ID is incomplete and the session is effectively a 0-byte/1-packet flow. In the provided samples, 3/5 events show network.application: incomplete with network.packets: 1 and destination.bytes: 0, which strongly suggests port-probe/noise rather than confirmed RPC. Tuning should focus on excluding PAN-OS “incomplete/1-packet/0-byte” flows (or requiring RPC App-ID) while retaining detections for confirmed DCE/RPC (e.g., Zeek zeek.dce_rpc or PAN-OS msrpc-base).

Query Modifications

PAN-OS port-based matching on TCP/135 triggers on network.application: incomplete (likely non-RPC/empty sessions), producing excessive alerts. (Impact: accuracy)

Modify →

network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc)
and not (
  event.dataset:panw.panos and
  network.application:incomplete and
  network.packets:1 and
  (destination.bytes:0 or network.bytes:[0 TO 100])
)

PAN-OS alerts may be more accurate when requiring a positive RPC App-ID for port 135 flows, rather than relying solely on port number. (Impact: both)

Modify →

(
  event.dataset:zeek.dce_rpc or
  (
    destination.port:135 and
    (
      not event.dataset:panw.panos or
      network.application:msrpc-base
    )
  )
)

Exception Recommendations

Add exception: network.application is "incomplete"

Modify →

and network.application is "incomplete"

Add exception: network.packets is "1"

Modify →

and network.packets is "1"

Add exception: destination.bytes is "0"

Modify →

and destination.bytes is "0"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-02-27

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	60.87
Version Status	✅ Established (29 release cycles)

Key Changes

• Daily Average: 7358
• Cluster Coverage: 0.8%
• CV: 0.60

Recommendation: Add exceptions to exclude known-benign PAN-OS security policies (rule.name) and the repeatedly-hit destination IP observed in alerts, since these patterns dominate the sample evidence and are likely environment-specific admin/DC traffic.

Rationale: This KQL rule is generating very high alert volume primarily from PAN-OS allowed outbound TCP/135 flows that appear to be legitimate (e.g., DC-to-DC management/replication and/or hairpin-to-org public IPs). The sample evidence shows repeated PAN-OS security policy names and repeated source/destination pairs, suggesting environment-specific, consistently-allowed traffic rather than opportunistic exploitation; the best immediate reduction is to add targeted exceptions keyed on the specific PAN-OS rule names and the repeatedly-hit destination IP seen in the alerts.

Query Modifications

Low-fidelity PAN-OS sessions (e.g., network.application: incomplete and/or zero-byte flows) can inflate alerts without strong evidence of successful RPC exposure. (Impact: accuracy)

Modify →

... and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and not network.application:"incomplete" ...

Broader-than-needed dataset/category clause can add work and match unintended network events when integrating multiple sources. (Impact: performance)

Modify →

(event.dataset:(panw.panos or network_traffic.flow or zeek.dce_rpc) or event.category:(network or network_traffic))

Exception Recommendations

Add exception: rule.name is "Azure DCs to All DCs"

Modify →

and rule.name is "Azure DCs to All DCs"

Add exception: rule.name is "policy-gp-to-lan"

Modify →

and rule.name is "policy-gp-to-lan"

Add exception: destination.ip is "156.26.1.114"

Modify →

and destination.ip is "156.26.1.114"

Add exception: source.ip is "10.66.8.5"

Modify →

and source.ip is "10.66.8.5"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-03-07

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	61.13
Version Status	✅ Established (29 release cycles)

Key Changes

• Daily Average: 10174
• Cluster Coverage: 0.8%
• CV: 0.64

Recommendation: Tighten PAN-OS matches to confirmed RPC by requiring network.application: "msrpc-base" (or excluding "incomplete"/very-low-packet sessions) while keeping Zeek DCE/RPC dataset matches intact.

Rationale: This rule is generating very high alert volume driven largely by PAN-OS flow logs where TCP/135 is observed but the traffic is not confidently identified as RPC (e.g., network.application: "incomplete") and by a small number of repeating internal sources/destinations. The current port-based logic is too broad for PANW data and will repeatedly alert on short/partial connections and non-RPC attempts to TCP/135. Tightening PANW matching to confirmed RPC (or excluding incomplete/low-packet flows) should materially reduce noise while preserving the intended detection of true RPC exposure.

Query Modifications

Port-only matching on PAN-OS produces high-volume matches for partial/ambiguous sessions (e.g., network.application: "incomplete"). (Impact: both)

Modify →

network.transport: tcp and (
  event.dataset: zeek.dce_rpc or
  (
    destination.port: 135 and
    (
      not event.dataset: panw.panos or
      (network.application: "msrpc-base" and network.packets >= 3)
    )
  )
)

Broad dataset/category selector increases search surface and can degrade performance and increase incidental matches across heterogeneous network sources. (Impact: performance)

Modify →

event.dataset: (panw.panos or network_traffic.flow or zeek.dce_rpc)

Exception Recommendations

Add exception: source.ip is "10.66.8.5"

Modify →

and source.ip is "10.66.8.5"

Add exception: source.ip is "10.228.0.14"

Modify →

and source.ip is "10.228.0.14"

Add exception: destination.ip is "12.187.43.48"

Modify →

and destination.ip is "12.187.43.48"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[tradebot-elastic]

Updated Analysis - 2026-03-14

Metric	Value
Category	NOISY_PERFORMANT
Priority	MEDIUM
Tuning Score	60.97
Version Status	✅ Established (30 release cycles)

Key Changes

• Daily Average: 6894
• Cluster Coverage: 1.0%
• CV: 0.58

Recommendation: Add exact destination IP exceptions for validated benign public RPC peers seen in the samples, and optionally exclude PANW network.application: incomplete traffic after confirming it dominates the remaining noise.

Rationale: This rule is producing high noise because it treats any RFC1918-to-non-reserved TCP/135 flow as Internet RPC, but the sample evidence shows repeated benign PANW msrpc-base traffic to likely organization-owned public IPs (Events 1-4) and at least one low-fidelity PANW network.application: incomplete connection (Event 5). The most effective tuning is to add narrow, environment-specific exact-IP exceptions for approved public RPC peers and, if validated in the wider alert set, harden the KQL to ignore PANW incomplete sessions.

Query Modifications

The current port-135 clause also matches low-fidelity PANW sessions where RPC was not actually established. (Impact: accuracy)

Modify →

network.transport: tcp and (event.dataset: zeek.dce_rpc or (destination.port: 135 and not (event.dataset: "panw.panos" and network.application: "incomplete")))

The rule lacks any allow-list for validated public RPC peers, so repeated benign destinations continue to alert. (Impact: accuracy)

Modify →

and not destination.ip : ("156.26.1.113" or "156.26.1.114" or "194.83.246.201" or "144.32.190.117")

Exception Recommendations

Add exception: destination.ip is one of "("156.26.1.113","156.26.1.114")"

Modify →

and destination.ip is one of "("156.26.1.113","156.26.1.114")"

Add exception: destination.ip is one of "("194.83.246.201","144.32.190.117")"

Modify →

and destination.ip is one of "("194.83.246.201","144.32.190.117")"

Add exception: network.application is "incomplete"

Modify →

and network.application is "incomplete"

---

Auto-updated by GenAI Tradecraft Rule Tuning Advisor

[eric-forte-elastic]

Rule tuned in #5932. Expected to be a significant reduction in noise.