Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Cisco WSA - Access to unwanted site

Back
Id38029e86-030c-46c4-8a91-a2be7c74d74c
RulenameCisco WSA - Access to unwanted site
DescriptionDetects when users attempting to access sites from high risk category.
SeverityHigh
TacticsInitialAccess
TechniquesT1566
Required data connectorsSyslogAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAAccessToUnwantedSite.yaml
Version1.0.3
Arm template38029e86-030c-46c4-8a91-a2be7c74d74c.json
Deploy To Azure
let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);
CiscoWSAEvent
| where UrlCategory in~ (risky_sites)
| where DvcAction =~ 'DEFAULT_CASE'
| extend AccountCustomEntity = SrcUserName
id: 38029e86-030c-46c4-8a91-a2be7c74d74c
relevantTechniques:
- T1566
status: Available
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAAccessToUnwantedSite.yaml
triggerThreshold: 0
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
description: |
    'Detects when users attempting to access sites from high risk category.'
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
severity: High
version: 1.0.3
tactics:
- InitialAccess
kind: Scheduled
name: Cisco WSA - Access to unwanted site
triggerOperator: gt
query: |
  let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);
  CiscoWSAEvent
  | where UrlCategory in~ (risky_sites)
  | where DvcAction =~ 'DEFAULT_CASE'
  | extend AccountCustomEntity = SrcUserName  
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/38029e86-030c-46c4-8a91-a2be7c74d74c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/38029e86-030c-46c4-8a91-a2be7c74d74c')]",
      "properties": {
        "alertRuleTemplateName": "38029e86-030c-46c4-8a91-a2be7c74d74c",
        "customDetails": null,
        "description": "'Detects when users attempting to access sites from high risk category.'\n",
        "displayName": "Cisco WSA - Access to unwanted site",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAAccessToUnwantedSite.yaml",
        "query": "let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);\nCiscoWSAEvent\n| where UrlCategory in~ (risky_sites)\n| where DvcAction =~ 'DEFAULT_CASE'\n| extend AccountCustomEntity = SrcUserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1566"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}