Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Apache - Multiple client errors from single IP

Back
Id15f5a956-3af9-11ec-8d3d-0242ac130003
RulenameApache - Multiple client errors from single IP
DescriptionDetects multiple client errors from one source in short timeframe
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsApacheHTTPServer
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheMultipleClientErrorsFromSingleIP.yaml
Version1.0.1
Arm template15f5a956-3af9-11ec-8d3d-0242ac130003.json
Deploy To Azure
let threshold = 100;
ApacheHTTPServer
| where HttpStatusCode >= 400 and HttpStatusCode <= 499
| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where MultipleClientErrors > threshold
| extend IPCustomEntity = SrcIpAddr
name: Apache - Multiple client errors from single IP
query: |
  let threshold = 100;
  ApacheHTTPServer
  | where HttpStatusCode >= 400 and HttpStatusCode <= 499
  | summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleClientErrors > threshold
  | extend IPCustomEntity = SrcIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheMultipleClientErrorsFromSingleIP.yaml
queryFrequency: 1h
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - ApacheHTTPServer
  connectorId: ApacheHTTPServer
version: 1.0.1
status: Available
queryPeriod: 1h
id: 15f5a956-3af9-11ec-8d3d-0242ac130003
triggerOperator: gt
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
relevantTechniques:
- T1190
- T1133
severity: Medium
description: |
    'Detects multiple client errors from one source in short timeframe'
kind: Scheduled
tactics:
- InitialAccess
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/15f5a956-3af9-11ec-8d3d-0242ac130003')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/15f5a956-3af9-11ec-8d3d-0242ac130003')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Apache - Multiple client errors from single IP",
        "description": "'Detects multiple client errors from one source in short timeframe'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let threshold = 100;\nApacheHTTPServer\n| where HttpStatusCode >= 400 and HttpStatusCode <= 499\n| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)\n| where MultipleClientErrors > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1133"
        ],
        "alertRuleTemplateName": "15f5a956-3af9-11ec-8d3d-0242ac130003",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "IPCustomEntity"
              }
            ],
            "entityType": "IP"
          }
        ],
        "status": "Available",
        "templateVersion": "1.0.1",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheMultipleClientErrorsFromSingleIP.yaml"
      }
    }
  ]
}