API - Invalid host access

Back


Id	28500be7-cfcf-40e1-bad4-bc524e9283e2
Rulename	API - Invalid host access
Description	42Crunch API protection against invalid host access
Severity	Low
Tactics	Reconnaissance
Techniques	T1592
Required data connectors	42CrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIInvalidHostAccess.yaml
Version	1.0.1
Arm template	28500be7-cfcf-40e1-bad4-bc524e9283e2.json

KQL

apifirewall_log_1_CL 
| where TimeGenerated >= ago(5m) 
| where Error_Step_s has "hostpath_mapping" 
| project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Response_Header_s, Request_Header_s, Errors_s, Type, UUID_g 
| sort by TimeGenerated desc

YAML

relevantTechniques:
- T1592
name: API - Invalid host access
queryFrequency: 5m
version: 1.0.1
triggerThreshold: 0
severity: Low
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
  dataTypes:
  - apifirewall_log_1_CL
tactics:
- Reconnaissance
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIInvalidHostAccess.yaml
query: |
  apifirewall_log_1_CL 
  | where TimeGenerated >= ago(5m) 
  | where Error_Step_s has "hostpath_mapping" 
  | project-away Non_blocking_mode_b, Source_Port_d, Destination_Port_d, Query_s, API_ID_g, Response_Header_s, Request_Header_s, Errors_s, Type, UUID_g 
  | sort by TimeGenerated desc   
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: Source_IP_s
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: Hostname_s
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: Instance_Name_s
    identifier: FullName
  entityType: Account
queryPeriod: 5m
triggerOperator: gt
customDetails: 
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 28500be7-cfcf-40e1-bad4-bc524e9283e2
status: Available
description: |
    '42Crunch API protection against invalid host access'

ARM