Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Palo Alto Prisma Cloud - Network ACL allow all outbound traffic

Back
Id4264e133-eec2-438f-af85-05e869308f94
RulenamePalo Alto Prisma Cloud - Network ACL allow all outbound traffic
DescriptionDetects network ACLs with outbound rule to allow all traffic.
SeverityMedium
TacticsInitialAccess
TechniquesT1133
Required data connectorsPaloAltoPrismaCloud
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudAclAllowAllOut.yaml
Version1.0.1
Arm template4264e133-eec2-438f-af85-05e869308f94.json
Deploy To Azure
PaloAltoPrismaCloud
| where Reason =~ 'NEW_ALERT'
| where Status =~ 'open'
| where AlertMessage has 'Network ACLs with Outbound rule to allow All Traffic'
| extend AccountCustomEntity = UserName
severity: Medium
relevantTechniques:
- T1133
requiredDataConnectors:
- dataTypes:
  - PaloAltoPrismaCloud
  connectorId: PaloAltoPrismaCloud
status: Available
triggerThreshold: 0
description: |
    'Detects network ACLs with outbound rule to allow all traffic.'
triggerOperator: gt
name: Palo Alto Prisma Cloud - Network ACL allow all outbound traffic
queryFrequency: 1h
version: 1.0.1
query: |
  PaloAltoPrismaCloud
  | where Reason =~ 'NEW_ALERT'
  | where Status =~ 'open'
  | where AlertMessage has 'Network ACLs with Outbound rule to allow All Traffic'
  | extend AccountCustomEntity = UserName  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
tactics:
- InitialAccess
queryPeriod: 1h
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudAclAllowAllOut.yaml
id: 4264e133-eec2-438f-af85-05e869308f94
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4264e133-eec2-438f-af85-05e869308f94')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4264e133-eec2-438f-af85-05e869308f94')]",
      "properties": {
        "alertRuleTemplateName": "4264e133-eec2-438f-af85-05e869308f94",
        "customDetails": null,
        "description": "'Detects network ACLs with outbound rule to allow all traffic.'\n",
        "displayName": "Palo Alto Prisma Cloud - Network ACL allow all outbound traffic",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudAclAllowAllOut.yaml",
        "query": "PaloAltoPrismaCloud\n| where Reason =~ 'NEW_ALERT'\n| where Status =~ 'open'\n| where AlertMessage has 'Network ACLs with Outbound rule to allow All Traffic'\n| extend AccountCustomEntity = UserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}