Palo Alto Prevention alert

Back


Id	5180e347-32fb-4a0a-9cfa-d6e0e10fc4eb
Rulename	Palo Alto Prevention alert
Description	The query checks for all malicious events prevented events across all devices having LogSeverity of ‘6’ and summarize the result.
Severity	Medium
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	PaloAltoNetworksCortex
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Palo Alto - XDR (Cortex)/Detection Queries/Preventive Alerts.yaml
Version	1.0.0
Arm template	5180e347-32fb-4a0a-9cfa-d6e0e10fc4eb.json

KQL

CommonSecurityLog
| where DeviceVendor == "Palo Alto Networks"
| where DeviceProduct == "Cortex XDR"
| where DeviceAction == "Prevented (Blocked)"
| where LogSeverity =~ "6"
| summarize by TimeGenerated,DeviceProduct, DeviceEventClassID, LogSeverity, Activity, DeviceAction, Computer, DeviceVersion, FileHash, FileName, FilePath, RequestURL, SourceHostName, SourceUserName
| sort by TimeGenerated

YAML

triggerOperator: gt
id: 5180e347-32fb-4a0a-9cfa-d6e0e10fc4eb
triggerThreshold: 0
kind: Scheduled
queryPeriod: 1d
severity: Medium
requiredDataConnectors:
- connectorId: PaloAltoNetworksCortex
  dataTypes:
  - PaloAltoNetworksCortex
queryFrequency: 1d
query: |
  CommonSecurityLog
  | where DeviceVendor == "Palo Alto Networks"
  | where DeviceProduct == "Cortex XDR"
  | where DeviceAction == "Prevented (Blocked)"
  | where LogSeverity =~ "6"
  | summarize by TimeGenerated,DeviceProduct, DeviceEventClassID, LogSeverity, Activity, DeviceAction, Computer, DeviceVersion, FileHash, FileName, FilePath, RequestURL, SourceHostName, SourceUserName
  | sort by TimeGenerated  
relevantTechniques:
- T1562
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: SourceUserName
    identifier: FullName
- entityType: Host
  fieldMappings:
  - columnName: SourceHostName
    identifier: FullName
- entityType: File hash
  fieldMappings:
  - columnName: FileHash
    identifier: Value
- entityType: File
  fieldMappings:
  - columnName: FileName
    identifier: Name
- entityType: File
  fieldMappings:
  - columnName: FilePath
    identifier: Name
- entityType: URL
  fieldMappings:
  - columnName: RequestURL
    identifier: Url
version: 1.0.0
tactics:
- DefenseEvasion
description: |
    'The query checks for all malicious events prevented events across all devices having LogSeverity of '6' and summarize the result.'
name: Palo Alto Prevention alert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Palo Alto - XDR (Cortex)/Detection Queries/Preventive Alerts.yaml

ARM