Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Apache - Multiple server errors from single IP

Back
Id1bf246a2-3af9-11ec-8d3d-0242ac130003
RulenameApache - Multiple server errors from single IP
DescriptionDetects multiple server errors from one source in short timeframe
SeverityMedium
TacticsImpact
InitialAccess
TechniquesT1498
T1190
T1133
Required data connectorsApacheHTTPServer
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheMultipleServerErrorsRequestsFromSingleIP.yaml
Version1.0.1
Arm template1bf246a2-3af9-11ec-8d3d-0242ac130003.json
Deploy To Azure
let threshold = 100;
ApacheHTTPServer
| where HttpStatusCode >= 500 and HttpStatusCode <= 599 
| summarize MultipleServerErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where MultipleServerErrors > threshold
| extend IPCustomEntity = SrcIpAddr
queryPeriod: 1h
version: 1.0.1
relevantTechniques:
- T1498
- T1190
- T1133
queryFrequency: 1h
kind: Scheduled
name: Apache - Multiple server errors from single IP
id: 1bf246a2-3af9-11ec-8d3d-0242ac130003
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheMultipleServerErrorsRequestsFromSingleIP.yaml
severity: Medium
query: |
  let threshold = 100;
  ApacheHTTPServer
  | where HttpStatusCode >= 500 and HttpStatusCode <= 599 
  | summarize MultipleServerErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleServerErrors > threshold
  | extend IPCustomEntity = SrcIpAddr  
tactics:
- Impact
- InitialAccess
description: |
    'Detects multiple server errors from one source in short timeframe'
requiredDataConnectors:
- connectorId: ApacheHTTPServer
  dataTypes:
  - ApacheHTTPServer
status: Available
triggerThreshold: 0
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1bf246a2-3af9-11ec-8d3d-0242ac130003')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1bf246a2-3af9-11ec-8d3d-0242ac130003')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Apache - Multiple server errors from single IP",
        "description": "'Detects multiple server errors from one source in short timeframe'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let threshold = 100;\nApacheHTTPServer\n| where HttpStatusCode >= 500 and HttpStatusCode <= 599 \n| summarize MultipleServerErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)\n| where MultipleServerErrors > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "InitialAccess"
        ],
        "techniques": [
          "T1498",
          "T1190",
          "T1133"
        ],
        "alertRuleTemplateName": "1bf246a2-3af9-11ec-8d3d-0242ac130003",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "IPCustomEntity"
              }
            ],
            "entityType": "IP"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ApacheHTTPServer/Analytic Rules/ApacheMultipleServerErrorsRequestsFromSingleIP.yaml",
        "status": "Available",
        "templateVersion": "1.0.1"
      }
    }
  ]
}