I have a customer that has several subnets under 172.16.0.0/16. Currently the HOME_NET is configured with that network. Analyst at the SOC would like to take certain subnets and make them EXTERNAL_NET. What is the order of operation regarding rule firing for HOME_NET and EXTERNAL_NET? Does one trump the other? I know that multiple YAML files can be created, but there are over 700 of those subnets! Thank You.
In most of the cases it will be enough to treat anything that is not within HOME_NET as external.
This is achieved through negating the HOME_NET(eg: EXTERNAL_NET: “!$HOME_NET”)
This however has one limitation, which is detecting lateral movement within the same network, if detecting lateral movements is not covered by other mechanisms and it is needed, you can either set external net to “any” or tune each rule individually.
Thank you for the answer. We will advise our Analyst.