Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Oracle - Multiple client errors from single IP

Back
Id41775080-5740-11ec-bf63-0242ac130002
RulenameOracle - Multiple client errors from single IP
DescriptionDetects multiple client errors from one source in short timeframe
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsOracleWebLogicServer
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicMultipleClientErrorsFromSingleIP.yaml
Version1.0.1
Arm template41775080-5740-11ec-bf63-0242ac130002.json
Deploy To Azure
let threshold = 100;
OracleWebLogicServerEvent
| where HttpStatusCode >= 400 and HttpStatusCode <= 499 
| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where MultipleClientErrors > threshold
| extend IPCustomEntity = SrcIpAddr
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicMultipleClientErrorsFromSingleIP.yaml
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
kind: Scheduled
query: |
  let threshold = 100;
  OracleWebLogicServerEvent
  | where HttpStatusCode >= 400 and HttpStatusCode <= 499 
  | summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleClientErrors > threshold
  | extend IPCustomEntity = SrcIpAddr  
triggerOperator: gt
version: 1.0.1
queryPeriod: 1h
name: Oracle - Multiple client errors from single IP
severity: Medium
relevantTechniques:
- T1190
- T1133
requiredDataConnectors:
- dataTypes:
  - OracleWebLogicServerEvent
  connectorId: OracleWebLogicServer
triggerThreshold: 0
tactics:
- InitialAccess
queryFrequency: 1h
id: 41775080-5740-11ec-bf63-0242ac130002
status: Available
description: |
    'Detects multiple client errors from one source in short timeframe'
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/41775080-5740-11ec-bf63-0242ac130002')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/41775080-5740-11ec-bf63-0242ac130002')]",
      "properties": {
        "alertRuleTemplateName": "41775080-5740-11ec-bf63-0242ac130002",
        "customDetails": null,
        "description": "'Detects multiple client errors from one source in short timeframe'\n",
        "displayName": "Oracle - Multiple client errors from single IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicMultipleClientErrorsFromSingleIP.yaml",
        "query": "let threshold = 100;\nOracleWebLogicServerEvent\n| where HttpStatusCode >= 400 and HttpStatusCode <= 499 \n| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)\n| where MultipleClientErrors > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}