let threshold = 5;
CiscoWSAEvent
| where UrlOriginal matches regex @'\Ahttp(s)?[:][/][/]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
| extend URLCustomEntity = UrlOriginal, AccountCustomEntity = SrcUserName
queryPeriod: 1h
query: |
let threshold = 5;
CiscoWSAEvent
| where UrlOriginal matches regex @'\Ahttp(s)?[:][/][/]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
| extend URLCustomEntity = UrlOriginal, AccountCustomEntity = SrcUserName
name: Cisco WSA - Unexpected URL
entityMappings:
- fieldMappings:
- columnName: URLCustomEntity
identifier: Url
entityType: URL
- fieldMappings:
- columnName: AccountCustomEntity
identifier: Name
entityType: Account
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAUnexpectedUrl.yaml
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
description: |
'Detects unexpected URL.'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1102
triggerOperator: gt
triggerThreshold: 0
tactics:
- CommandAndControl
id: 010644fd-2830-4451-9e0e-606cc192f2e7
