Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Oracle - Multiple user agents for single source

Back
Id44c7d12a-573f-11ec-bf63-0242ac130002
RulenameOracle - Multiple user agents for single source
DescriptionDetects requests with different user agents from one source in short timeframe.
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsOracleWebLogicServer
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicDifferentUAsFromSingleIP.yaml
Version1.0.1
Arm template44c7d12a-573f-11ec-bf63-0242ac130002.json
Deploy To Azure
let threshold = 5;
OracleWebLogicServerEvent
| where isnotempty(HttpUserAgentOriginal)
| summarize ua_count=makeset(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
| where array_length(ua_count) > threshold
| extend IPCustomEntity = SrcIpAddr
triggerOperator: gt
version: 1.0.1
query: |
  let threshold = 5;
  OracleWebLogicServerEvent
  | where isnotempty(HttpUserAgentOriginal)
  | summarize ua_count=makeset(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
  | where array_length(ua_count) > threshold
  | extend IPCustomEntity = SrcIpAddr  
status: Available
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicDifferentUAsFromSingleIP.yaml
queryFrequency: 1h
requiredDataConnectors:
- connectorId: OracleWebLogicServer
  dataTypes:
  - OracleWebLogicServerEvent
name: Oracle - Multiple user agents for single source
queryPeriod: 1h
severity: Medium
kind: Scheduled
tactics:
- InitialAccess
id: 44c7d12a-573f-11ec-bf63-0242ac130002
description: |
    'Detects requests with different user agents from one source in short timeframe.'
relevantTechniques:
- T1190
- T1133
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/44c7d12a-573f-11ec-bf63-0242ac130002')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/44c7d12a-573f-11ec-bf63-0242ac130002')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Oracle - Multiple user agents for single source",
        "description": "'Detects requests with different user agents from one source in short timeframe.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let threshold = 5;\nOracleWebLogicServerEvent\n| where isnotempty(HttpUserAgentOriginal)\n| summarize ua_count=makeset(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)\n| where array_length(ua_count) > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1133"
        ],
        "alertRuleTemplateName": "44c7d12a-573f-11ec-bf63-0242ac130002",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicDifferentUAsFromSingleIP.yaml",
        "status": "Available",
        "templateVersion": "1.0.1"
      }
    }
  ]
}