Cisco SEG - Possible outbreak

Back


Id	53242559-95ea-4d4c-b003-107e8f06304b
Rulename	Cisco SEG - Possible outbreak
Description	Detects possible outbreak activity.
Severity	Medium
Tactics	InitialAccess
Techniques	T1566
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGPossibleOutbreak.yaml
Version	1.0.3
Arm template	53242559-95ea-4d4c-b003-107e8f06304b.json

KQL

CiscoSEGEvent
| where NetworkDirection =~ 'Incoming'
| where tostring(AdditionalFields) has 'ESAOFVerdict'
| extend of_verdict = extract(@'ESAOFVerdict":"(NOT_EVALUATED|POSITIVE|NEGATIVE)"', 1, tostring(AdditionalFields))
| where of_verdict =~ 'POSITIVE'
| extend AccountCustomEntity = DstUserName

YAML

relevantTechniques:
- T1566
queryFrequency: 1h
description: |
    'Detects possible outbreak activity.'
triggerThreshold: 0
id: 53242559-95ea-4d4c-b003-107e8f06304b
name: Cisco SEG - Possible outbreak
queryPeriod: 1h
query: |
  CiscoSEGEvent
  | where NetworkDirection =~ 'Incoming'
  | where tostring(AdditionalFields) has 'ESAOFVerdict'
  | extend of_verdict = extract(@'ESAOFVerdict":"(NOT_EVALUATED|POSITIVE|NEGATIVE)"', 1, tostring(AdditionalFields))
  | where of_verdict =~ 'POSITIVE'
  | extend AccountCustomEntity = DstUserName  
severity: Medium
triggerOperator: gt
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoSEG/Analytic Rules/CiscoSEGPossibleOutbreak.yaml
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
status: Available
version: 1.0.3
tactics:
- InitialAccess
kind: Scheduled

ARM