Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Imperva - Request from unexpected IP address to admin panel

Back
Id427c025d-c068-4844-8205-66879e89bcfa
RulenameImperva - Request from unexpected IP address to admin panel
DescriptionDetects requests from unexpected IP addresses to admin panel.
SeverityHigh
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsImpervaWAFCloudAPI
KindScheduled
Query frequency10m
Query period10m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ImpervaCloudWAF/Analytic Rules/ImpervaAdminPanelUncommonIp.yaml
Version1.0.1
Arm template427c025d-c068-4844-8205-66879e89bcfa.json
Deploy To Azure
ImpervaWAFCloud
| where QueryString contains @'/admin'
| where ipv4_is_private(SrcIpAddr) == False
| extend IPCustomEntity = SrcIpAddr
triggerOperator: gt
id: 427c025d-c068-4844-8205-66879e89bcfa
queryFrequency: 10m
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
requiredDataConnectors:
- dataTypes:
  - ImpervaWAFCloud
  connectorId: ImpervaWAFCloudAPI
severity: High
triggerThreshold: 0
kind: Scheduled
status: Available
queryPeriod: 10m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ImpervaCloudWAF/Analytic Rules/ImpervaAdminPanelUncommonIp.yaml
query: |
  ImpervaWAFCloud
  | where QueryString contains @'/admin'
  | where ipv4_is_private(SrcIpAddr) == False
  | extend IPCustomEntity = SrcIpAddr  
description: |
    'Detects requests from unexpected IP addresses to admin panel.'
name: Imperva - Request from unexpected IP address to admin panel
relevantTechniques:
- T1190
- T1133
tactics:
- InitialAccess
version: 1.0.1
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/427c025d-c068-4844-8205-66879e89bcfa')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/427c025d-c068-4844-8205-66879e89bcfa')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Imperva - Request from unexpected IP address to admin panel",
        "description": "'Detects requests from unexpected IP addresses to admin panel.'\n",
        "severity": "High",
        "enabled": true,
        "query": "ImpervaWAFCloud\n| where QueryString contains @'/admin'\n| where ipv4_is_private(SrcIpAddr) == False\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1133"
        ],
        "alertRuleTemplateName": "427c025d-c068-4844-8205-66879e89bcfa",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "IPCustomEntity"
              }
            ],
            "entityType": "IP"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ImpervaCloudWAF/Analytic Rules/ImpervaAdminPanelUncommonIp.yaml",
        "templateVersion": "1.0.1",
        "status": "Available"
      }
    }
  ]
}