Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Tomcat - Multiple client errors from single IP address

Back
Id4fa66058-4870-11ec-81d3-0242ac130003
RulenameTomcat - Multiple client errors from single IP address
DescriptionDetects multiple client errors from one source in short timeframe
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsCustomLogsAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatMultipleClientErrorsFromSingleIP.yaml
Version1.0.2
Arm template4fa66058-4870-11ec-81d3-0242ac130003.json
Deploy To Azure
let threshold = 100;
TomcatEvent
| where HttpStatusCode >= 400 and HttpStatusCode <= 499 
| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where MultipleClientErrors > threshold
| extend IPCustomEntity = SrcIpAddr
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
triggerThreshold: 0
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatMultipleClientErrorsFromSingleIP.yaml
queryFrequency: 1h
status: Available
relevantTechniques:
- T1190
- T1133
triggerOperator: gt
id: 4fa66058-4870-11ec-81d3-0242ac130003
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - Tomcat_CL
version: 1.0.2
name: Tomcat - Multiple client errors from single IP address
description: |
    'Detects multiple client errors from one source in short timeframe'
query: |
  let threshold = 100;
  TomcatEvent
  | where HttpStatusCode >= 400 and HttpStatusCode <= 499 
  | summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleClientErrors > threshold
  | extend IPCustomEntity = SrcIpAddr  
tactics:
- InitialAccess
queryPeriod: 1h
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4fa66058-4870-11ec-81d3-0242ac130003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4fa66058-4870-11ec-81d3-0242ac130003')]",
      "properties": {
        "alertRuleTemplateName": "4fa66058-4870-11ec-81d3-0242ac130003",
        "customDetails": null,
        "description": "'Detects multiple client errors from one source in short timeframe'\n",
        "displayName": "Tomcat - Multiple client errors from single IP address",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatMultipleClientErrorsFromSingleIP.yaml",
        "query": "let threshold = 100;\nTomcatEvent\n| where HttpStatusCode >= 400 and HttpStatusCode <= 499 \n| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)\n| where MultipleClientErrors > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}