Contrast Blocks

Back


Id	4396f8c3-d114-4154-9f4c-048ba522ed04
Rulename	Contrast Blocks
Description	Creates Incidents for Blocked events sourced from the Contrast Protect agent.
Severity	Low
Tactics	InitialAccess Exfiltration
Techniques	T1566
Required data connectors	CefAma ContrastProtect ContrastProtectAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml
Version	1.0.2
Arm template	4396f8c3-d114-4154-9f4c-048ba522ed04.json

KQL

let extract_data=(a:string, k:string) {
  parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
};

CommonSecurityLog 
| where DeviceVendor == "Contrast Security"
| where AdditionalExtensions contains "BLOCKED"
| extend DeviceProduct
| extend SourceIP
| extend DeviceVersion
| extend Activity
| extend ApplicationProtocol
| extend RequestURL
| extend RequestMethod
| extend Rule = extract_data(AdditionalExtensions, 'pri')

YAML

queryFrequency: 5m
id: 4396f8c3-d114-4154-9f4c-048ba522ed04
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastBlocks.yaml
query: |
  let extract_data=(a:string, k:string) {
    parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
  };

  CommonSecurityLog 
  | where DeviceVendor == "Contrast Security"
  | where AdditionalExtensions contains "BLOCKED"
  | extend DeviceProduct
  | extend SourceIP
  | extend DeviceVersion
  | extend Activity
  | extend ApplicationProtocol
  | extend RequestURL
  | extend RequestMethod
  | extend Rule = extract_data(AdditionalExtensions, 'pri')  
queryPeriod: 5m
kind: Scheduled
status: Available
customDetails:
  AgentVersion: DeviceVersion
  Agent: DeviceProduct
  Details: AdditionalExtensions
  Application: ApplicationProtocol
  Attack: Activity
name: Contrast Blocks
triggerThreshold: 0
relevantTechniques:
- T1566
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
- fieldMappings:
  - identifier: Url
    columnName: RequestURL
  entityType: URL
- fieldMappings:
  - identifier: Name
    columnName: ApplicationProtocol
  entityType: CloudApplication
- fieldMappings:
  - identifier: Name
    columnName: Activity
  - identifier: Category
    columnName: Rule
  entityType: Malware
requiredDataConnectors:
- connectorId: ContrastProtect
  dataTypes:
  - CommonSecurityLog
- connectorId: ContrastProtectAma
  dataTypes:
  - CommonSecurityLog
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
version: 1.0.2
severity: Low
description: |
    'Creates Incidents for Blocked events sourced from the Contrast Protect agent.'
tactics:
- InitialAccess
- Exfiltration

ARM