The Darktrace AAD Conundrum: Configuring Anomalous Activity Detectors for Optimal Performance

8 August 2024

DESCRIPTION: Learn how to configure Darktrace’s Anomalous Activity Detectors for improved threat detection and response.
The Darktrace AAD Conundrum: Configuring Anomalous Activity Detectors for Optimal Performance

Using Darktrace for Network Security?

Darktrace is a renowned cybersecurity solution that utilizes machine learning algorithms to detect and respond to threats in real-time. One of its key features, the Anomalous Activity Detector (AAD), allows sysops to set custom rules for anomaly detection. However, configuring AAD can be challenging due to the vast array of options available.

Understanding Anomaly Detection

Anomaly detection is a technique used by Darktrace to identify unusual patterns in network activity that may indicate a security threat. The AAD feature enables sysops to define what constitutes an anomalous activity, thereby allowing for more precise threat detection and response.

Configuring the AAD

To configure the AAD, follow these steps:

Access the Darktrace dashboard and navigate to the “Anomalous Activity Detectors” section.
Click on the “+” icon to create a new AAD rule.
Define the criteria for anomalous activity, including IP addresses, ports, protocols, and other relevant factors.
Set the threshold for anomaly detection based on the defined criteria.
Choose the severity level for alerts generated by the AAD.

Example Code Snippet

Here’s an example of how to configure a simple AAD rule using Darktrace’s API:

import darktrace_api
# Initialize the Darktrace API client
api = darktrace_api.DarktraceAPI(
    api_key="your_api_key",
    api_secret="your_api_secret"
)
# Create a new AAD rule
aad_rule = {
    "name": "Example AAD Rule",
    "description": "Anomalous activity on port 22",
    "criteria": [
        {
            "field": "destination_port",
            "operator": "EQ",
            "value": 22
        }
    ],
    "threshold": 5,
    "severity_level": 3
}
# Create the AAD rule using the Darktrace API
response = api.create_aad_rule(aad_rule)
# Check if the AAD rule was created successfully
if response.status_code == 201:
    print("AAD rule created successfully!")
else:
    print("Error creating AAD rule:", response.text)

Best Practices for Configuring AAD

When configuring the AAD, keep in mind the following best practices:

Define clear criteria for anomalous activity to minimize false positives.
Set a threshold that balances detection sensitivity with alert noise.
Choose a severity level that reflects the importance of the detected anomaly.
By following these steps and best practices, sysops can configure Darktrace’s Anomalous Activity Detectors for optimal performance and improved threat detection and response.

Poespas Blog