Imperva - Multiple user agents from same source

Back


Id	4e8032eb-f04d-4a30-85d3-b74bf2c8f204
Rulename	Imperva - Multiple user agents from same source
Description	‘Detects suspicious number of user agents from the same IP address.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	ImpervaWAFCloudAPI
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ImpervaCloudWAF/Analytic Rules/ImpervaMultipleUAsSource.yaml
Version	1.0.0
Arm template	4e8032eb-f04d-4a30-85d3-b74bf2c8f204.json

KQL

let threshold = 10;
ImpervaWAFCloud
| summarize d_uas = dcount(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
| where d_uas >= threshold
| extend IPCustomEntity = SrcIpAddr

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ImpervaCloudWAF/Analytic Rules/ImpervaMultipleUAsSource.yaml
queryFrequency: 1h
name: Imperva - Multiple user agents from same source
severity: Medium
triggerThreshold: 0
query: |
  let threshold = 10;
  ImpervaWAFCloud
  | summarize d_uas = dcount(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
  | where d_uas >= threshold
  | extend IPCustomEntity = SrcIpAddr  
requiredDataConnectors:
- dataTypes:
  - ImpervaWAFCloud
  connectorId: ImpervaWAFCloudAPI
relevantTechniques:
- T1190
- T1133
status: Available
triggerOperator: gt
queryPeriod: 1h
description: |
    ''Detects suspicious number of user agents from the same IP address.'
id: 4e8032eb-f04d-4a30-85d3-b74bf2c8f204
version: 1.0.0
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
kind: Scheduled
tactics:
- InitialAccess

ARM