Imperva - Multiple user agents from same source

Back


Id	4e8032eb-f04d-4a30-85d3-b74bf2c8f204
Rulename	Imperva - Multiple user agents from same source
Description	‘Detects suspicious number of user agents from the same IP address.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	ImpervaWAFCloudAPI
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ImpervaCloudWAF/Analytic Rules/ImpervaMultipleUAsSource.yaml
Version	1.0.0
Arm template	4e8032eb-f04d-4a30-85d3-b74bf2c8f204.json

KQL

let threshold = 10;
ImpervaWAFCloud
| summarize d_uas = dcount(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
| where d_uas >= threshold
| extend IPCustomEntity = SrcIpAddr

YAML

version: 1.0.0
severity: Medium
query: |
  let threshold = 10;
  ImpervaWAFCloud
  | summarize d_uas = dcount(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
  | where d_uas >= threshold
  | extend IPCustomEntity = SrcIpAddr  
queryPeriod: 1h
status: Available
kind: Scheduled
tactics:
- InitialAccess
triggerOperator: gt
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ImpervaCloudWAF/Analytic Rules/ImpervaMultipleUAsSource.yaml
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
name: Imperva - Multiple user agents from same source
triggerThreshold: 0
description: |
    ''Detects suspicious number of user agents from the same IP address.'
id: 4e8032eb-f04d-4a30-85d3-b74bf2c8f204
relevantTechniques:
- T1190
- T1133
requiredDataConnectors:
- connectorId: ImpervaWAFCloudAPI
  dataTypes:
  - ImpervaWAFCloud

ARM