Zscaler - ZPA connections from new IP

Back


Id	24f0779d-3927-403a-aac1-cc8791653606
Rulename	Zscaler - ZPA connections from new IP
Description	Detects ZPA connections from new IP.
Severity	Medium
Tactics	InitialAccess
Techniques	T1078 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsFromNewIP.yaml
Version	1.0.2
Arm template	24f0779d-3927-403a-aac1-cc8791653606.json

KQL

let listIPs =
ZPAEvent 
| where TimeGenerated > ago(14d)
| where DvcAction == 'open'
| summarize ListofIPs = make_set(SrcIpAddr) by DstUserName
| project ListofIPs;
ZPAEvent
| where isnotempty(SrcIpAddr)
| where SrcIpAddr !in (listIPs)
| summarize EventCount = count() by DstUserName, SrcIpAddr
| project-away EventCount
| extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName

YAML

queryPeriod: 14d
query: |
  let listIPs =
  ZPAEvent 
  | where TimeGenerated > ago(14d)
  | where DvcAction == 'open'
  | summarize ListofIPs = make_set(SrcIpAddr) by DstUserName
  | project ListofIPs;
  ZPAEvent
  | where isnotempty(SrcIpAddr)
  | where SrcIpAddr !in (listIPs)
  | summarize EventCount = count() by DstUserName, SrcIpAddr
  | project-away EventCount
  | extend IPCustomEntity = SrcIpAddr, AccountCustomEntity = DstUserName  
name: Zscaler - ZPA connections from new IP
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Zscaler Private Access (ZPA)/Analytic Rules/ZscalerZPAConnectionsFromNewIP.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - ZPA_CL
description: |
    'Detects ZPA connections from new IP.'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1078
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: 24f0779d-3927-403a-aac1-cc8791653606

ARM