Cisco WSA - Access to unwanted site | Microsoft Sentinel Analytic Rules

Back


Id	38029e86-030c-46c4-8a91-a2be7c74d74c
Rulename	Cisco WSA - Access to unwanted site
Description	Detects when users attempting to access sites from high risk category.
Severity	High
Tactics	InitialAccess
Techniques	T1566
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic%20Rules/CiscoWSAAccessToUnwantedSite.yaml
Version	1.0.3
Arm template	38029e86-030c-46c4-8a91-a2be7c74d74c.json

KQL

let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);
CiscoWSAEvent
| where UrlCategory in~ (risky_sites)
| where DvcAction =~ 'DEFAULT_CASE'
| extend AccountCustomEntity = SrcUserName

YAML

name: Cisco WSA - Access to unwanted site
version: 1.0.3
query: |
  let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);
  CiscoWSAEvent
  | where UrlCategory in~ (risky_sites)
  | where DvcAction =~ 'DEFAULT_CASE'
  | extend AccountCustomEntity = SrcUserName
kind: Scheduled
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
severity: High
status: Available
relevantTechniques:
- T1566
tactics:
- InitialAccess
queryFrequency: 1h
description: |
  'Detects when users attempting to access sites from high risk category.'
id: 38029e86-030c-46c4-8a91-a2be7c74d74c
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
queryPeriod: 1h
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic%20Rules/CiscoWSAAccessToUnwantedSite.yaml
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/38029e86-030c-46c4-8a91-a2be7c74d74c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/38029e86-030c-46c4-8a91-a2be7c74d74c')]",
      "properties": {
        "alertRuleTemplateName": "38029e86-030c-46c4-8a91-a2be7c74d74c",
        "customDetails": null,
        "description": "'Detects when users attempting to access sites from high risk category.'\n",
        "displayName": "Cisco WSA - Access to unwanted site",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic%20Rules/CiscoWSAAccessToUnwantedSite.yaml",
        "query": "let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);\nCiscoWSAEvent\n| where UrlCategory in~ (risky_sites)\n| where DvcAction =~ 'DEFAULT_CASE'\n| extend AccountCustomEntity = SrcUserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1566"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}