Cisco WSA - Unexpected URL

Back


Id	010644fd-2830-4451-9e0e-606cc192f2e7
Rulename	Cisco WSA - Unexpected URL
Description	Detects unexpected URL.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1102
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAUnexpectedUrl.yaml
Version	1.0.2
Arm template	010644fd-2830-4451-9e0e-606cc192f2e7.json

KQL

let threshold = 5;
CiscoWSAEvent
| where UrlOriginal matches regex @'\Ahttp(s)?[:][/][/]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
| extend URLCustomEntity = UrlOriginal, AccountCustomEntity = SrcUserName

YAML

name: Cisco WSA - Unexpected URL
id: 010644fd-2830-4451-9e0e-606cc192f2e7
description: |
    'Detects unexpected URL.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: URLCustomEntity
    identifier: Url
  entityType: URL
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
version: 1.0.2
triggerOperator: gt
query: |
  let threshold = 5;
  CiscoWSAEvent
  | where UrlOriginal matches regex @'\Ahttp(s)?[:][/][/]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
  | extend URLCustomEntity = UrlOriginal, AccountCustomEntity = SrcUserName  
tactics:
- CommandAndControl
kind: Scheduled
queryFrequency: 1h
severity: Medium
queryPeriod: 1h
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAUnexpectedUrl.yaml
relevantTechniques:
- T1102

ARM