SIEM supply chain threat detection

StackOps provides SIEM rules for detecting software supply chain attacks. These rules equip security teams with immediate, actionable indicators of compromise (IoCs) before they impact production environments.

These SIEM rules are powered by StackOps’ in-house Supply Chain Threat Intelligence Pipeline. This pipeline is an automated, cloud-native system that proactively collects, standardises, and enriches intelligence from high-confidence vulnerability databases and cutting-edge security research.

SIEM rules for supply chain threats

StackOps automatically enables six IoC-match SIEM rules for supply chain threats. Each rule scans your telemetry data from the last 30 days, matching it against the curated threat intelligence in stored in StackOps’ central threat indices:

1. [SIEM] Threat Intel Package Indicator Match — Detects events containing an impacted software package version.
2. [SIEM] Threat Intel IP Indicator Match — Detects events containing a malicous IP address.
3. [SIEM] Threat Intel Domain Indicator Match — Detects events containing a malicious URL domain.
4. [SIEM] Threat Intel URL Indicator Match — Detects events containing a malicous URL address.
5. [SIEM] Threat Intel Hash Indicator Match — Detects events containing a malicous file.
6. [SIEM] Threat Intel Container Image Match — Detects events containing an impacted image digest.

You can view the detailed rules in Innersource or on Kibana (Security > Rules > Detection rules (SIEM)).

With these six rules enabled, users get broad supply chain coverage across dependencies, infrastructure IoCs, and container artifacts, with earlier warning on malicious packages and lower noise via StackOps sanitisation and normalisation.

1. Package Indicator Match

The Package Indicator Match rule detects known malicious/suspicious software packages across various ecosystems, such as npm, PyPI, Go, and GitHub Actions. It is useful for blocking known bad dependencies and compromised Actions quickly.

Relevant fields:

• threat.indicator.type = software
• threat.indicator.supply_chain.package.ecosystem
• threat.indicator.supply_chain.package.name
• threat.indicator.supply_chain.package.affected_versions

Note: The Package Indicator Match rule applies only to deployments that use SORA, which provides your telemetry data for matching against IoCs.

2. IP Indicator Match

The IP Indicator Match rule detects connections to attacker C2/exfiltration IPs tied to supply chain campaigns. To prevent false positives, private/reserved ranges and common resolver DNSes are excluded from the threat intelligence.

Relevant fields:

• threat.indicator.type = ipv4-addr
• threat.indicator.ip

3. Domain Indicator Match

The Domain Indicator Match detects DNS/host activity to known malicious campaign domains. To prevent false positives, bare TLDs/hostnames and legitimate domains are excluded from the threat intelligence.

Relevant fields:

• threat.indicator.type = domain-name
• threat.indicator.url.domain

4. URL Indicator Match

The URL Indicator Match rules detects HTTP/S requests to known malicious URLs from supply chain incidents. To prevent false positives, Non-HTTP(S) schemes are excluded from the threat intelligence.

Relevant fields:

• threat.indicator.type = url
• threat.indicator.url.full

5. Hash Indicator Match

The Hash Indicator Match rule detects file hashes associated with malicious payloads from supply chain attacks.

Relevant fields:

• threat.indicator.type = file
• threat.indicator.file.hash.sha256

6. Container Image Match

The Container Image Match rule detects known compromised container images/tags and digests tied to supply chain attack campaigns.

Relevant fields:

• threat.indicator.type = container-image
• threat.indicator.supply_chain.container.image
• threat.indicator.supply_chain.container.tag
• threat.indicator.supply_chain.container.digests

Note: The Container Image Indicator Match rule applies only to deployments that use SORA, which provides your telemetry data for matching against IoCs.

Alerts

Once a match is found, an alert will appear in Kibana in Security > Alerts.

You can use the following fields, if available, to triage incident priority:

• event.severity — Severity of the incident, normalised numerically from 1 to 4 (critical to low).
• threat.indicator.confidence — Confidence of the indicator, which can be high or medium. Medium-confidence indicators may need a quick source check before escalation.

StackOps Supply Chain Threat Intelligence Pipeline

The StackOps pipeline aggregates intelligence data from three sources and indexes them into a single, continuously-updated data stream on Elasticsearch:

• OSV.dev API — Provides advisories and information on malicious packages.
• Socket.dev API — Provides information on malicious packages detected via automated analysis.
• Security research blogs — Provide in-depth supply chain campaign analyses, with package names, IOCs, and campaign attribution not captured by OSV.dev and Socket.dev APIs.

Data source coverage

Data is fetched at 30min intervals for the APIs and at 1h intervals for blogs. Each data source provides for a number of indicator types, which affects which rules can fire. Here is a summary of the data sources for each SIEM rule:

LLM-powered data extraction

For security research blogs, the StackOps pipeline uses LLMs to extract indicators (IPs, domains, URLs, file hashes, package names, and container image details) from unstructured article text. To reduce false positives and noise from blog data, the extracted indicators pass through validation and sanitisation before they are indexed and used by SIEM rules:

• Private/reserved IPs and common resolver IPs are filtered.
• Invalid or trivial hashes are rejected.
• Domain and URL checks remove malformed and known legitimate-service values.

Advantages

The pipeline provides the following advantages:

• Automated, continuous updates — Data is fetched on fixed schedules, eliminating manual data refresh cycles.
• Standardised format — All threat data is normalised to Elastic Common Schema (ECS), enabling direct integration with any SIEM platform without custom parsing.

Known limitations

The StackOps pipeline has the following limitations, which affects the coverage and precision users can expect:

• File hash and container image detections depend heavily on blog-derived indicators. Coverage solely relies on AI-assisted extracted indicators, which may introduce occasional false positives.