Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

NGINX - Multiple client errors from single IP address

Back
Id42771afe-edb3-4330-bc4a-abf6a5714454
RulenameNGINX - Multiple client errors from single IP address
DescriptionDetects multiple client errors from one source in short timeframe
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsCustomLogsAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXMultipleClientErrorsFromSingleIP.yaml
Version1.0.2
Arm template42771afe-edb3-4330-bc4a-abf6a5714454.json
Deploy To Azure
let threshold = 100;
NGINXHTTPServer
| where tolong(HttpStatusCode) >= 400 and tolong(HttpStatusCode) <= 499 
| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where MultipleClientErrors > threshold
| extend IPCustomEntity = SrcIpAddr
status: Available
id: 42771afe-edb3-4330-bc4a-abf6a5714454
query: |
  let threshold = 100;
  NGINXHTTPServer
  | where tolong(HttpStatusCode) >= 400 and tolong(HttpStatusCode) <= 499 
  | summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleClientErrors > threshold
  | extend IPCustomEntity = SrcIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXMultipleClientErrorsFromSingleIP.yaml
description: |
    'Detects multiple client errors from one source in short timeframe'
name: NGINX - Multiple client errors from single IP address
relevantTechniques:
- T1190
- T1133
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
triggerThreshold: 0
severity: Medium
requiredDataConnectors:
- dataTypes:
  - NGINX_CL
  connectorId: CustomLogsAma
queryFrequency: 1h
queryPeriod: 1h
version: 1.0.2
kind: Scheduled
tactics:
- InitialAccess
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/42771afe-edb3-4330-bc4a-abf6a5714454')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/42771afe-edb3-4330-bc4a-abf6a5714454')]",
      "properties": {
        "alertRuleTemplateName": "42771afe-edb3-4330-bc4a-abf6a5714454",
        "customDetails": null,
        "description": "'Detects multiple client errors from one source in short timeframe'\n",
        "displayName": "NGINX - Multiple client errors from single IP address",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXMultipleClientErrorsFromSingleIP.yaml",
        "query": "let threshold = 100;\nNGINXHTTPServer\n| where tolong(HttpStatusCode) >= 400 and tolong(HttpStatusCode) <= 499 \n| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)\n| where MultipleClientErrors > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}