Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Contrast Blocks

Back
Id4396f8c3-d114-4154-9f4c-048ba522ed04
RulenameContrast Blocks
DescriptionCreates Incidents for Blocked events sourced from the Contrast Protect agent.
SeverityLow
TacticsInitialAccess
Exfiltration
TechniquesT1566
Required data connectorsContrastProtect
ContrastProtectAma
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml
Version1.0.1
Arm template4396f8c3-d114-4154-9f4c-048ba522ed04.json
Deploy To Azure
let extract_data=(a:string, k:string) {
  parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
};

CommonSecurityLog 
| where DeviceVendor == "Contrast Security"
| where AdditionalExtensions contains "BLOCKED"
| extend DeviceProduct
| extend SourceIP
| extend DeviceVersion
| extend Activity
| extend ApplicationProtocol
| extend RequestURL
| extend RequestMethod
| extend Rule = extract_data(AdditionalExtensions, 'pri')
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml
severity: Low
name: Contrast Blocks
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: SourceIP
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: RequestURL
    identifier: Url
- entityType: CloudApplication
  fieldMappings:
  - columnName: ApplicationProtocol
    identifier: Name
- entityType: Malware
  fieldMappings:
  - columnName: Activity
    identifier: Name
  - columnName: Rule
    identifier: Category
relevantTechniques:
- T1566
queryFrequency: 5m
triggerThreshold: 0
queryPeriod: 5m
description: |
    'Creates Incidents for Blocked events sourced from the Contrast Protect agent.'
id: 4396f8c3-d114-4154-9f4c-048ba522ed04
customDetails:
  Attack: Activity
  Details: AdditionalExtensions
  Agent: DeviceProduct
  Application: ApplicationProtocol
  AgentVersion: DeviceVersion
version: 1.0.1
tactics:
- InitialAccess
- Exfiltration
query: |
  let extract_data=(a:string, k:string) {
    parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
  };

  CommonSecurityLog 
  | where DeviceVendor == "Contrast Security"
  | where AdditionalExtensions contains "BLOCKED"
  | extend DeviceProduct
  | extend SourceIP
  | extend DeviceVersion
  | extend Activity
  | extend ApplicationProtocol
  | extend RequestURL
  | extend RequestMethod
  | extend Rule = extract_data(AdditionalExtensions, 'pri')  
status: Available
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: ContrastProtect
- dataTypes:
  - CommonSecurityLog
  connectorId: ContrastProtectAma
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4396f8c3-d114-4154-9f4c-048ba522ed04')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4396f8c3-d114-4154-9f4c-048ba522ed04')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Contrast Blocks",
        "description": "'Creates Incidents for Blocked events sourced from the Contrast Protect agent.'\n",
        "severity": "Low",
        "enabled": true,
        "query": "let extract_data=(a:string, k:string) {\n  parse_urlquery(replace(@';', @'&', a))[\"Query Parameters\"][k]\n};\n\nCommonSecurityLog \n| where DeviceVendor == \"Contrast Security\"\n| where AdditionalExtensions contains \"BLOCKED\"\n| extend DeviceProduct\n| extend SourceIP\n| extend DeviceVersion\n| extend Activity\n| extend ApplicationProtocol\n| extend RequestURL\n| extend RequestMethod\n| extend Rule = extract_data(AdditionalExtensions, 'pri')\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "Exfiltration"
        ],
        "techniques": [
          "T1566"
        ],
        "alertRuleTemplateName": "4396f8c3-d114-4154-9f4c-048ba522ed04",
        "customDetails": {
          "Application": "ApplicationProtocol",
          "Agent": "DeviceProduct",
          "AgentVersion": "DeviceVersion",
          "Details": "AdditionalExtensions",
          "Attack": "Activity"
        },
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "SourceIP"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "identifier": "Url",
                "columnName": "RequestURL"
              }
            ]
          },
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "ApplicationProtocol"
              }
            ]
          },
          {
            "entityType": "Malware",
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "Activity"
              },
              {
                "identifier": "Category",
                "columnName": "Rule"
              }
            ]
          }
        ],
        "templateVersion": "1.0.1",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml",
        "status": "Available"
      }
    }
  ]
}