Monitoring outside of working hours

• Purpose: Enable outside working hours alert triggering.

• Update the Lists: Update the "Working Hours" list for each customer.

• Why: To activate "outside working hours" monitoring rules for additional context.

Introduction

The purpose of this guide is to present an explanation of the term "Monitoring activity outside of working hours”.

The "Monitoring Activity Outside of Working Hours" feature in Mobula Platform provides continuous 24/7 surveillance of critical assets and infrastructure. It detects and alerts security personnel to unusual behaviors, potential threats, and security breaches that may occur during non-business hours. By correlating events and analyzing user behavior, this capability ensures prompt incident detection, response, and compliance with regulatory requirements.

Cyray list of outside working hours monitoring rules:

How to activate Monitoring outside of working hours

Via ESM

1. On the Navigator window, under “Resources” tab, go to “Lists”

2. follow the path: /All Active Lists/Mobula/Enrichment & Inventory/Working Hours - Days Off/Working Hours by Days - Customers (see picture *)

3. Right-click - show entries

4. On the Viewer, search for blue “+” button

5. A new Inspect/Edit window will appear on the right side of the screen, where you can add the following values: (see picture **)

• Customer - Choose the customer

• DayOfWeek - The day of the week represented by a number 1 - Sunday, 2 - Monday, ..., 6 - Friday, 7 - Saturday ( add every day separately)

• StartTimeHour - The starting work hour 

• EndTimeHour - The ending work hour (e.g., 19 represents 19:00, it's until this hour and not including it) 

• IsDayOff - If it's defined as a day off (1 - not a workday, 0 - workday) 

If it is a day off, leave the hour field empty.

• Minutes- are not relevant at this stage.

Finally, you should get results that look like this:

Supporting rules (WH & OH):

Mobula Master utilizes parent-child logic for Working Hours (WH) and Outside Working Hours (OH) rules. While ArcSight retains the parent's Generator ID, the MobRuleID distinguishes the specific context by appending a 'WH' or 'OH' suffix.

for example:

NOTE: 

1. To ensure exclusions and rule stage changes are processed correctly, they must be mapped to the MobRuleID. Targeting the Generator ID will apply the exclusion too broadly or incorrectly, failing to achieve the desired result.
   
   

2. Cymate tool supports exclusion and stage change based on MobRuleID.

For MSSP Managers

After reviewing this guide send an email to all of your customers asking them about their working hours in order to activate this option. Explain to them about rules from cyray’s list that you think are important to be monitored in these aspects and make some suggestions to them.

We usually add a description of this email that looks like that:

“Dear Customer,

In order to reduce the risks of attacks, improves real-time monitoring alerts, and enhances the incident response and actions taken by the security operations team

Please send back details about the organization's working hours.

By adjusting and activating working hours monitoring, we are able to best control alerts that are popping up regarding your systems. If you have any other aspects that you want to implement, feel free to let us know

Best Regards…”

Regarding new customers, please add this feature as part of the onboarding process.

Troubleshooting

Outside Working hours alert trigger within working hours or vice versa:

• Verify that the working hours entries for the specific customer match the client’s actual schedule.
  
  

• Verify the reporting device’s time zone configuration. If the event end time recorded in the log significantly differs from the time the log was received by the system, this may indicate a time zone misconfiguration on the device. Check the “End Time” Value and the “DeviceTimeZone”

Exclusion or stage change not taking effect:

• Verify that MobRuleID was used for the exclusion/stage change, not the generator ID.