CTERA Mass Deletions Detection Analytic

Back


Id	5365f294-0c67-432a-bacf-b1282a3b6c46
Rulename	CTERA Mass Deletions Detection Analytic
Description	This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer
Severity	High
Tactics	Impact
Techniques	T1485
Required data connectors	CTERA
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	5000
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassDeletions.yaml
Version	1.0.0
Arm template	5365f294-0c67-432a-bacf-b1282a3b6c46.json

KQL

Syslog
| where ProcessName == 'gw-audit'
| extend
    TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
    UserName = extract("user=([^|]*)", 1, SyslogMessage),
    Permission = extract("op=([^|]*)", 1, SyslogMessage),
    EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
    RootPath = extract("rootPath=([^|]*)", 1, SyslogMessage),
    Share = extract("share=([^|]*)", 1, SyslogMessage),
    LocalPath = extract("path=([^|]*)", 1, SyslogMessage),
    Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
| where Permission == 'delete'
| summarize Count = count() by UserName, bin(Timestamp, 5m)
| where Count > 5000

YAML

name: CTERA Mass Deletions Detection Analytic
relevantTechniques:
- T1485
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
  createIncident: true
eventGroupingSettings:
  aggregationKind: SingleAlert
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: CTERA
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassDeletions.yaml
query: |
  Syslog
  | where ProcessName == 'gw-audit'
  | extend
      TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
      UserName = extract("user=([^|]*)", 1, SyslogMessage),
      Permission = extract("op=([^|]*)", 1, SyslogMessage),
      EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
      RootPath = extract("rootPath=([^|]*)", 1, SyslogMessage),
      Share = extract("share=([^|]*)", 1, SyslogMessage),
      LocalPath = extract("path=([^|]*)", 1, SyslogMessage),
      Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
  | where Permission == 'delete'
  | summarize Count = count() by UserName, bin(Timestamp, 5m)
  | where Count > 5000  
tactics:
- Impact
description: This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer
entityMappings:
- fieldMappings:
  - columnName: UserName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: EdgeFiler
    identifier: Name
  entityType: File
suppressionEnabled: false
queryFrequency: 5m
alertDetailsOverride:
  alertDescriptionFormat: |
        Detected {{Count}} denied access attempts by user {{UserName}} on Edge Filer  {{EdgeFiler}} within 5 minutes. Please investigate unauthorized access attempts or misconfigurations.
  alertnameFormat: CTERA Batch Access Denied Detection
triggerOperator: GreaterThan
suppressionDuration: PT5H
version: 1.0.0
queryPeriod: 5m
status: Available
kind: Scheduled
severity: High
triggerThreshold: 5000
id: 5365f294-0c67-432a-bacf-b1282a3b6c46
customDetails:
  Share: Share
  RootPath: RootPath
  TenantName: TenantName
  UserName: UserName
  EdgeFiler: EdgeFiler

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5365f294-0c67-432a-bacf-b1282a3b6c46')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5365f294-0c67-432a-bacf-b1282a3b6c46')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Detected {{Count}} denied access attempts by user {{UserName}} on Edge Filer  {{EdgeFiler}} within 5 minutes. Please investigate unauthorized access attempts or misconfigurations.\n",
          "alertnameFormat": "CTERA Batch Access Denied Detection"
        },
        "alertRuleTemplateName": "5365f294-0c67-432a-bacf-b1282a3b6c46",
        "customDetails": {
          "EdgeFiler": "EdgeFiler",
          "RootPath": "RootPath",
          "Share": "Share",
          "TenantName": "TenantName",
          "UserName": "UserName"
        },
        "description": "This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer",
        "displayName": "CTERA Mass Deletions Detection Analytic",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "File",
            "fieldMappings": [
              {
                "columnName": "EdgeFiler",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassDeletions.yaml",
        "query": "Syslog\n| where ProcessName == 'gw-audit'\n| extend\n    TenantName = extract(\"\\\"vportal\\\":\\\"([^\\\"]*)\\\"\", 1, SyslogMessage),\n    UserName = extract(\"user=([^|]*)\", 1, SyslogMessage),\n    Permission = extract(\"op=([^|]*)\", 1, SyslogMessage),\n    EdgeFiler = extract(\"\\\"client\\\":\\\"([^\\\"]*)\\\"\", 1, SyslogMessage),\n    RootPath = extract(\"rootPath=([^|]*)\", 1, SyslogMessage),\n    Share = extract(\"share=([^|]*)\", 1, SyslogMessage),\n    LocalPath = extract(\"path=([^|]*)\", 1, SyslogMessage),\n    Timestamp = todatetime(extract(\"\\\"@timestamp\\\":\\\"([^\\\"]*)\\\"\", 1, SyslogMessage))\n| where Permission == 'delete'\n| summarize Count = count() by UserName, bin(Timestamp, 5m)\n| where Count > 5000\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 5000
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}