API - Invalid host access

Back


Id	28500be7-cfcf-40e1-bad4-bc524e9283e2
Rulename	API - Invalid host access
Description	42Crunch API protection against invalid host access
Severity	Low
Tactics	Reconnaissance
Techniques	T1592
Required data connectors	42CrunchAPIProtection FortyTwoCrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIInvalidHostAccess.yaml
Version	3.0.1
Arm template	28500be7-cfcf-40e1-bad4-bc524e9283e2.json

KQL

FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| where ErrorMessage has "hostpath_mapping" 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, ResponseHeader, RequestHeader, Errors, EventType, Uuid 
| sort by TimeGenerated desc

YAML

entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIp
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Hostname
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: InstanceName
tactics:
- Reconnaissance
requiredDataConnectors:
- dataTypes:
  - FortyTwoCrunchAPIProtection
  connectorId: 42CrunchAPIProtection
- dataTypes:
  - FortyTwoCrunchAPIProtection
  connectorId: FortyTwoCrunchAPIProtection
id: 28500be7-cfcf-40e1-bad4-bc524e9283e2
severity: Low
status: Available
customDetails: 
query: |
  FortyTwoCrunchAPIProtection
  | where TimeGenerated >= ago(5m) 
  | where ErrorMessage has "hostpath_mapping" 
  | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, ResponseHeader, RequestHeader, Errors, EventType, Uuid 
  | sort by TimeGenerated desc   
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIInvalidHostAccess.yaml
kind: Scheduled
queryPeriod: 5m
version: 3.0.1
name: API - Invalid host access
queryFrequency: 5m
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1592
description: |
    '42Crunch API protection against invalid host access'
triggerThreshold: 0
triggerOperator: gt

ARM