API - Anomaly Detection

Back


Id	2c59e609-e0a0-4e8e-adc5-ab4224be8a36
Rulename	API - Anomaly Detection
Description	42Crunch API protection anomaly detection
Severity	Low
Tactics	Reconnaissance
Techniques	T1593 T1589
Required data connectors	42CrunchAPIProtection FortyTwoCrunchAPIProtection
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAnomalyDetection.yaml
Version	3.0.1
Arm template	2c59e609-e0a0-4e8e-adc5-ab4224be8a36.json

KQL

let infoRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/users/info" and Status == 200;
let timestamp = toscalar(infoRec | top 1 by Timestamp desc | summarize by Timestamp);
let activityRec = FortyTwoCrunchAPIProtection
  | where Timestamp < timestamp and TimeGenerated >= ago(5m)
  | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
  | where UriPath has "/api/users/activity" and Status == 200;
activityRec

YAML

status: Available
queryFrequency: 5m
query: |
  let infoRec = FortyTwoCrunchAPIProtection
  | where TimeGenerated >= ago(5m) 
  | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
  | where UriPath has "/api/users/info" and Status == 200;
  let timestamp = toscalar(infoRec | top 1 by Timestamp desc | summarize by Timestamp);
  let activityRec = FortyTwoCrunchAPIProtection
    | where Timestamp < timestamp and TimeGenerated >= ago(5m)
    | project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
    | where UriPath has "/api/users/activity" and Status == 200;
  activityRec  
customDetails: 
id: 2c59e609-e0a0-4e8e-adc5-ab4224be8a36
name: API - Anomaly Detection
tactics:
- Reconnaissance
queryPeriod: 5m
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SourceIp
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: Hostname
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: InstanceName
  entityType: Account
eventGroupingSettings:
  aggregationKind: SingleAlert
kind: Scheduled
severity: Low
triggerOperator: gt
version: 3.0.1
description: |
    '42Crunch API protection anomaly detection'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/42Crunch API Protection/Analytic Rules/APIAnomalyDetection.yaml
requiredDataConnectors:
- dataTypes:
  - FortyTwoCrunchAPIProtection
  connectorId: 42CrunchAPIProtection
- dataTypes:
  - FortyTwoCrunchAPIProtection
  connectorId: FortyTwoCrunchAPIProtection
relevantTechniques:
- T1593
- T1589
triggerThreshold: 0

ARM