Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Cloudflare - Client request from country in blocklist

Back
Id40554544-6e4a-4413-8d14-bf2de939c5d9
RulenameCloudflare - Client request from country in blocklist
DescriptionDetects requests from countries which are in blocklist.
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsCloudflareDataConnector
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedCountry.yaml
Version1.0.0
Arm template40554544-6e4a-4413-8d14-bf2de939c5d9.json
Deploy To Azure
let bl_countries = dynamic(['cn', 'hk']);
Cloudflare
| where SrcGeoCountry in~ (bl_countries)
| extend IPCustomEntity = SrcIpAddr
| extend UrlCustomEntity = ClientRequestURI
name: Cloudflare - Client request from country in blocklist
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedCountry.yaml
queryPeriod: 1h
version: 1.0.0
severity: Medium
id: 40554544-6e4a-4413-8d14-bf2de939c5d9
triggerOperator: gt
triggerThreshold: 0
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - Cloudflare
  connectorId: CloudflareDataConnector
relevantTechniques:
- T1190
- T1133
description: |
    'Detects requests from countries which are in blocklist.'
query: |
  let bl_countries = dynamic(['cn', 'hk']);
  Cloudflare
  | where SrcGeoCountry in~ (bl_countries)
  | extend IPCustomEntity = SrcIpAddr
  | extend UrlCustomEntity = ClientRequestURI  
tactics:
- InitialAccess
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
status: Available
queryFrequency: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/40554544-6e4a-4413-8d14-bf2de939c5d9')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/40554544-6e4a-4413-8d14-bf2de939c5d9')]",
      "properties": {
        "alertRuleTemplateName": "40554544-6e4a-4413-8d14-bf2de939c5d9",
        "customDetails": null,
        "description": "'Detects requests from countries which are in blocklist.'\n",
        "displayName": "Cloudflare - Client request from country in blocklist",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "UrlCustomEntity",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedCountry.yaml",
        "query": "let bl_countries = dynamic(['cn', 'hk']);\nCloudflare\n| where SrcGeoCountry in~ (bl_countries)\n| extend IPCustomEntity = SrcIpAddr\n| extend UrlCustomEntity = ClientRequestURI\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}