Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Cloudflare - Client request from country in blocklist

Back
Id40554544-6e4a-4413-8d14-bf2de939c5d9
RulenameCloudflare - Client request from country in blocklist
DescriptionDetects requests from countries which are in blocklist.
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsCloudflareDataConnector
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedCountry.yaml
Version1.0.0
Arm template40554544-6e4a-4413-8d14-bf2de939c5d9.json
Deploy To Azure
let bl_countries = dynamic(['cn', 'hk']);
Cloudflare
| where SrcGeoCountry in~ (bl_countries)
| extend IPCustomEntity = SrcIpAddr
| extend UrlCustomEntity = ClientRequestURI
queryFrequency: 1h
triggerThreshold: 0
name: Cloudflare - Client request from country in blocklist
version: 1.0.0
id: 40554544-6e4a-4413-8d14-bf2de939c5d9
status: Available
tactics:
- InitialAccess
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
queryPeriod: 1h
description: |
    'Detects requests from countries which are in blocklist.'
requiredDataConnectors:
- connectorId: CloudflareDataConnector
  dataTypes:
  - Cloudflare
query: |
  let bl_countries = dynamic(['cn', 'hk']);
  Cloudflare
  | where SrcGeoCountry in~ (bl_countries)
  | extend IPCustomEntity = SrcIpAddr
  | extend UrlCustomEntity = ClientRequestURI  
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedCountry.yaml
triggerOperator: gt
relevantTechniques:
- T1190
- T1133
severity: Medium
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/40554544-6e4a-4413-8d14-bf2de939c5d9')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/40554544-6e4a-4413-8d14-bf2de939c5d9')]",
      "properties": {
        "alertRuleTemplateName": "40554544-6e4a-4413-8d14-bf2de939c5d9",
        "customDetails": null,
        "description": "'Detects requests from countries which are in blocklist.'\n",
        "displayName": "Cloudflare - Client request from country in blocklist",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "UrlCustomEntity",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedCountry.yaml",
        "query": "let bl_countries = dynamic(['cn', 'hk']);\nCloudflare\n| where SrcGeoCountry in~ (bl_countries)\n| extend IPCustomEntity = SrcIpAddr\n| extend UrlCustomEntity = ClientRequestURI\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}