Contrast Blocks
Id | 4396f8c3-d114-4154-9f4c-048ba522ed04 |
Rulename | Contrast Blocks |
Description | Creates Incidents for Blocked events sourced from the Contrast Protect agent. |
Severity | Low |
Tactics | InitialAccess Exfiltration |
Techniques | T1566 |
Required data connectors | ContrastProtect ContrastProtectAma |
Kind | Scheduled |
Query frequency | 5m |
Query period | 5m |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml |
Version | 1.0.1 |
Arm template | 4396f8c3-d114-4154-9f4c-048ba522ed04.json |
let extract_data=(a:string, k:string) {
parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
};
CommonSecurityLog
| where DeviceVendor == "Contrast Security"
| where AdditionalExtensions contains "BLOCKED"
| extend DeviceProduct
| extend SourceIP
| extend DeviceVersion
| extend Activity
| extend ApplicationProtocol
| extend RequestURL
| extend RequestMethod
| extend Rule = extract_data(AdditionalExtensions, 'pri')
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml
severity: Low
name: Contrast Blocks
entityMappings:
- entityType: IP
fieldMappings:
- columnName: SourceIP
identifier: Address
- entityType: URL
fieldMappings:
- columnName: RequestURL
identifier: Url
- entityType: CloudApplication
fieldMappings:
- columnName: ApplicationProtocol
identifier: Name
- entityType: Malware
fieldMappings:
- columnName: Activity
identifier: Name
- columnName: Rule
identifier: Category
relevantTechniques:
- T1566
queryFrequency: 5m
triggerThreshold: 0
queryPeriod: 5m
description: |
'Creates Incidents for Blocked events sourced from the Contrast Protect agent.'
id: 4396f8c3-d114-4154-9f4c-048ba522ed04
customDetails:
Attack: Activity
Details: AdditionalExtensions
Agent: DeviceProduct
Application: ApplicationProtocol
AgentVersion: DeviceVersion
version: 1.0.1
tactics:
- InitialAccess
- Exfiltration
query: |
let extract_data=(a:string, k:string) {
parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
};
CommonSecurityLog
| where DeviceVendor == "Contrast Security"
| where AdditionalExtensions contains "BLOCKED"
| extend DeviceProduct
| extend SourceIP
| extend DeviceVersion
| extend Activity
| extend ApplicationProtocol
| extend RequestURL
| extend RequestMethod
| extend Rule = extract_data(AdditionalExtensions, 'pri')
status: Available
requiredDataConnectors:
- dataTypes:
- CommonSecurityLog
connectorId: ContrastProtect
- dataTypes:
- CommonSecurityLog
connectorId: ContrastProtectAma
triggerOperator: gt
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4396f8c3-d114-4154-9f4c-048ba522ed04')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4396f8c3-d114-4154-9f4c-048ba522ed04')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01-preview",
"properties": {
"displayName": "Contrast Blocks",
"description": "'Creates Incidents for Blocked events sourced from the Contrast Protect agent.'\n",
"severity": "Low",
"enabled": true,
"query": "let extract_data=(a:string, k:string) {\n parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\n\nCommonSecurityLog \n| where DeviceVendor == \"Contrast Security\"\n| where AdditionalExtensions contains \"BLOCKED\"\n| extend DeviceProduct\n| extend SourceIP\n| extend DeviceVersion\n| extend Activity\n| extend ApplicationProtocol\n| extend RequestURL\n| extend RequestMethod\n| extend Rule = extract_data(AdditionalExtensions, 'pri')\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"InitialAccess",
"Exfiltration"
],
"techniques": [
"T1566"
],
"alertRuleTemplateName": "4396f8c3-d114-4154-9f4c-048ba522ed04",
"customDetails": {
"Application": "ApplicationProtocol",
"Agent": "DeviceProduct",
"AgentVersion": "DeviceVersion",
"Details": "AdditionalExtensions",
"Attack": "Activity"
},
"entityMappings": [
{
"entityType": "IP",
"fieldMappings": [
{
"identifier": "Address",
"columnName": "SourceIP"
}
]
},
{
"entityType": "URL",
"fieldMappings": [
{
"identifier": "Url",
"columnName": "RequestURL"
}
]
},
{
"entityType": "CloudApplication",
"fieldMappings": [
{
"identifier": "Name",
"columnName": "ApplicationProtocol"
}
]
},
{
"entityType": "Malware",
"fieldMappings": [
{
"identifier": "Name",
"columnName": "Activity"
},
{
"identifier": "Category",
"columnName": "Rule"
}
]
}
],
"templateVersion": "1.0.1",
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml",
"status": "Available"
}
}
]
}