Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Cisco WSA - Access to unwanted site

Back
Id38029e86-030c-46c4-8a91-a2be7c74d74c
RulenameCisco WSA - Access to unwanted site
DescriptionDetects when users attempting to access sites from high risk category.
SeverityHigh
TacticsInitialAccess
TechniquesT1566
Required data connectorsSyslogAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAAccessToUnwantedSite.yaml
Version1.0.3
Arm template38029e86-030c-46c4-8a91-a2be7c74d74c.json
Deploy To Azure
let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);
CiscoWSAEvent
| where UrlCategory in~ (risky_sites)
| where DvcAction =~ 'DEFAULT_CASE'
| extend AccountCustomEntity = SrcUserName
query: |
  let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);
  CiscoWSAEvent
  | where UrlCategory in~ (risky_sites)
  | where DvcAction =~ 'DEFAULT_CASE'
  | extend AccountCustomEntity = SrcUserName  
description: |
    'Detects when users attempting to access sites from high risk category.'
id: 38029e86-030c-46c4-8a91-a2be7c74d74c
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
name: Cisco WSA - Access to unwanted site
status: Available
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAAccessToUnwantedSite.yaml
kind: Scheduled
triggerOperator: gt
version: 1.0.3
relevantTechniques:
- T1566
queryFrequency: 1h
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
tactics:
- InitialAccess
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/38029e86-030c-46c4-8a91-a2be7c74d74c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/38029e86-030c-46c4-8a91-a2be7c74d74c')]",
      "properties": {
        "alertRuleTemplateName": "38029e86-030c-46c4-8a91-a2be7c74d74c",
        "customDetails": null,
        "description": "'Detects when users attempting to access sites from high risk category.'\n",
        "displayName": "Cisco WSA - Access to unwanted site",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoWSA/Analytic Rules/CiscoWSAAccessToUnwantedSite.yaml",
        "query": "let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);\nCiscoWSAEvent\n| where UrlCategory in~ (risky_sites)\n| where DvcAction =~ 'DEFAULT_CASE'\n| extend AccountCustomEntity = SrcUserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1566"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}