Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

NGINX - Multiple client errors from single IP address

Back
Id42771afe-edb3-4330-bc4a-abf6a5714454
RulenameNGINX - Multiple client errors from single IP address
DescriptionDetects multiple client errors from one source in short timeframe
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsNGINXHTTPServer
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXMultipleClientErrorsFromSingleIP.yaml
Version1.0.0
Arm template42771afe-edb3-4330-bc4a-abf6a5714454.json
Deploy To Azure
let threshold = 100;
NGINXHTTPServer
| where tolong(HttpStatusCode) >= 400 and tolong(HttpStatusCode) <= 499 
| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where MultipleClientErrors > threshold
| extend IPCustomEntity = SrcIpAddr
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXMultipleClientErrorsFromSingleIP.yaml
id: 42771afe-edb3-4330-bc4a-abf6a5714454
name: NGINX - Multiple client errors from single IP address
query: |
  let threshold = 100;
  NGINXHTTPServer
  | where tolong(HttpStatusCode) >= 400 and tolong(HttpStatusCode) <= 499 
  | summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleClientErrors > threshold
  | extend IPCustomEntity = SrcIpAddr  
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryPeriod: 1h
triggerThreshold: 0
tactics:
- InitialAccess
version: 1.0.0
kind: Scheduled
relevantTechniques:
- T1190
- T1133
queryFrequency: 1h
status: Available
requiredDataConnectors:
- dataTypes:
  - NGINXHTTPServer
  connectorId: NGINXHTTPServer
description: |
    'Detects multiple client errors from one source in short timeframe'
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/42771afe-edb3-4330-bc4a-abf6a5714454')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/42771afe-edb3-4330-bc4a-abf6a5714454')]",
      "properties": {
        "alertRuleTemplateName": "42771afe-edb3-4330-bc4a-abf6a5714454",
        "customDetails": null,
        "description": "'Detects multiple client errors from one source in short timeframe'\n",
        "displayName": "NGINX - Multiple client errors from single IP address",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXMultipleClientErrorsFromSingleIP.yaml",
        "query": "let threshold = 100;\nNGINXHTTPServer\n| where tolong(HttpStatusCode) >= 400 and tolong(HttpStatusCode) <= 499 \n| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)\n| where MultipleClientErrors > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}