Wazuh - Large Number of Web errors from an IP

Back


Id	2790795b-7dba-483e-853f-44aa0bc9c985
Rulename	Wazuh - Large Number of Web errors from an IP
Description	Identifies instances where Wazuh logged over 400 ‘403’ Web Errors from one IP Address. To onboard Wazuh data into Sentinel please view: https://documentation.wazuh.com/current/cloud-security/azure/index.html
Severity	Low
Tactics	CredentialAccess
Techniques	T1110
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/Wazuh-Large_Number_of_Web_errors_from_an_IP.yaml
Version	1.0.5
Arm template	2790795b-7dba-483e-853f-44aa0bc9c985.json

KQL

CommonSecurityLog
| where DeviceProduct =~ "Wazuh"
| where Activity has "Web server 400 error code."
| where Message has "403"
| extend HostName=substring(split(DeviceCustomString1,")")[0],1)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), NumberOfErrors = dcount(SourceIP) by HostName, SourceIP
| where NumberOfErrors > 400
| sort by NumberOfErrors desc
| extend timestamp = StartTime

YAML

requiredDataConnectors: []
relevantTechniques:
- T1110
triggerOperator: gt
version: 1.0.5
metadata:
  categories:
    domains:
    - Security - Others
    - Networking
  source:
    kind: Community
  support:
    tier: Community
  author:
    name: Jordan Ross
queryFrequency: 1d
severity: Low
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: SourceIP
    identifier: Address
  entityType: IP
name: Wazuh - Large Number of Web errors from an IP
query: |
  CommonSecurityLog
  | where DeviceProduct =~ "Wazuh"
  | where Activity has "Web server 400 error code."
  | where Message has "403"
  | extend HostName=substring(split(DeviceCustomString1,")")[0],1)
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), NumberOfErrors = dcount(SourceIP) by HostName, SourceIP
  | where NumberOfErrors > 400
  | sort by NumberOfErrors desc
  | extend timestamp = StartTime  
tactics:
- CredentialAccess
queryPeriod: 1d
description: |
    'Identifies instances where Wazuh logged over 400 '403' Web Errors from one IP Address. To onboard Wazuh data into Sentinel please view: https://documentation.wazuh.com/current/cloud-security/azure/index.html'
kind: Scheduled
id: 2790795b-7dba-483e-853f-44aa0bc9c985
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CommonSecurityLog/Wazuh-Large_Number_of_Web_errors_from_an_IP.yaml

ARM