DDoS Attack IP Addresses - Percent Threshold

Back


Id	402a42ad-f31c-48d1-8f80-0200846b7f25
Rulename	DDoS Attack IP Addresses - Percent Threshold
Description	Identifies IP addresses that generate over 5% of traffic during DDoS attack mitigation
Severity	Medium
Tactics	Impact
Techniques	T1498
Required data connectors	DDOS
Kind	Scheduled
Query frequency	2h
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPercentThreshold.yaml
Version	1.0.1
Arm template	402a42ad-f31c-48d1-8f80-0200846b7f25.json

KQL

let T1 = AzureDiagnostics
  | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
  | summarize rows_count = count() by destPublicIpAddress_s, sourcePublicIpAddress_s;
let T2 = AzureDiagnostics
  | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
  | summarize rows_total = count() by destPublicIpAddress_s;
T2
  | join kind=leftouter T1 on destPublicIpAddress_s
  | project destPublicIpAddress_s, sourcePublicIpAddress_s, percent_of_traffic = 100*rows_count/rows_total
  | order by percent_of_traffic desc
  | where percent_of_traffic > 5

YAML

kind: Scheduled
severity: Medium
description: Identifies IP addresses that generate over 5% of traffic during DDoS attack mitigation
triggerThreshold: 0
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPercentThreshold.yaml
relevantTechniques:
- T1498
version: 1.0.1
tactics:
- Impact
triggerOperator: gt
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: sourcePublicIpAddress_s
  entityType: IP
requiredDataConnectors:
- connectorId: DDOS
  dataTypes:
  - AzureDiagnostics
queryPeriod: 2h
query: |
  let T1 = AzureDiagnostics
    | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
    | summarize rows_count = count() by destPublicIpAddress_s, sourcePublicIpAddress_s;
  let T2 = AzureDiagnostics
    | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
    | summarize rows_total = count() by destPublicIpAddress_s;
  T2
    | join kind=leftouter T1 on destPublicIpAddress_s
    | project destPublicIpAddress_s, sourcePublicIpAddress_s, percent_of_traffic = 100*rows_count/rows_total
    | order by percent_of_traffic desc
    | where percent_of_traffic > 5  
name: DDoS Attack IP Addresses - Percent Threshold
queryFrequency: 2h
id: 402a42ad-f31c-48d1-8f80-0200846b7f25
eventGroupingSettings:
  aggregationKind: SingleAlert

ARM