Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Oracle - Multiple server errors from single IP

Back
Id268f4fde-5740-11ec-bf63-0242ac130002
RulenameOracle - Multiple server errors from single IP
DescriptionDetects multiple server errors from one source in short timeframe
SeverityMedium
TacticsImpact
InitialAccess
TechniquesT1498
T1190
T1133
Required data connectorsCustomLogsAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicMultipleServerErrorsRequestsFromSingleIP.yaml
Version1.0.3
Arm template268f4fde-5740-11ec-bf63-0242ac130002.json
Deploy To Azure
let threshold = 100;
OracleWebLogicServerEvent
| where HttpStatusCode >= 500 and HttpStatusCode <= 599 
| summarize MultipleServerErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where MultipleServerErrors > threshold
| extend IPCustomEntity = SrcIpAddr
id: 268f4fde-5740-11ec-bf63-0242ac130002
triggerOperator: gt
status: Available
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
description: |
    'Detects multiple server errors from one source in short timeframe'
severity: Medium
version: 1.0.3
relevantTechniques:
- T1498
- T1190
- T1133
tactics:
- Impact
- InitialAccess
name: Oracle - Multiple server errors from single IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicMultipleServerErrorsRequestsFromSingleIP.yaml
query: |
  let threshold = 100;
  OracleWebLogicServerEvent
  | where HttpStatusCode >= 500 and HttpStatusCode <= 599 
  | summarize MultipleServerErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleServerErrors > threshold
  | extend IPCustomEntity = SrcIpAddr  
kind: Scheduled
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - OracleWebLogicServer_CL
  connectorId: CustomLogsAma
queryPeriod: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/268f4fde-5740-11ec-bf63-0242ac130002')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/268f4fde-5740-11ec-bf63-0242ac130002')]",
      "properties": {
        "alertRuleTemplateName": "268f4fde-5740-11ec-bf63-0242ac130002",
        "customDetails": null,
        "description": "'Detects multiple server errors from one source in short timeframe'\n",
        "displayName": "Oracle - Multiple server errors from single IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicMultipleServerErrorsRequestsFromSingleIP.yaml",
        "query": "let threshold = 100;\nOracleWebLogicServerEvent\n| where HttpStatusCode >= 500 and HttpStatusCode <= 599 \n| summarize MultipleServerErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)\n| where MultipleServerErrors > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190",
          "T1498"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}