CTERA Mass Deletions Detection Analytic

Back


Id	5365f294-0c67-432a-bacf-b1282a3b6c46
Rulename	CTERA Mass Deletions Detection Analytic
Description	This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer
Severity	High
Tactics	Impact
Techniques	T1485
Required data connectors	CTERA
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	5000
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassDeletions.yaml
Version	1.0.0
Arm template	5365f294-0c67-432a-bacf-b1282a3b6c46.json

KQL

Syslog
| where ProcessName == 'gw-audit'
| extend
    TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
    UserName = extract("user=([^|]*)", 1, SyslogMessage),
    Permission = extract("op=([^|]*)", 1, SyslogMessage),
    EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
    RootPath = extract("rootPath=([^|]*)", 1, SyslogMessage),
    Share = extract("share=([^|]*)", 1, SyslogMessage),
    LocalPath = extract("path=([^|]*)", 1, SyslogMessage),
    Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
| where Permission == 'delete'
| summarize Count = count() by UserName, bin(Timestamp, 5m)
| where Count > 5000

YAML

customDetails:
  UserName: UserName
  EdgeFiler: EdgeFiler
  Share: Share
  RootPath: RootPath
  TenantName: TenantName
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassDeletions.yaml
alertDetailsOverride:
  alertDescriptionFormat: |
        Detected {{Count}} denied access attempts by user {{UserName}} on Edge Filer  {{EdgeFiler}} within 5 minutes. Please investigate unauthorized access attempts or misconfigurations.
  alertnameFormat: CTERA Batch Access Denied Detection
query: |
  Syslog
  | where ProcessName == 'gw-audit'
  | extend
      TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
      UserName = extract("user=([^|]*)", 1, SyslogMessage),
      Permission = extract("op=([^|]*)", 1, SyslogMessage),
      EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
      RootPath = extract("rootPath=([^|]*)", 1, SyslogMessage),
      Share = extract("share=([^|]*)", 1, SyslogMessage),
      LocalPath = extract("path=([^|]*)", 1, SyslogMessage),
      Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
  | where Permission == 'delete'
  | summarize Count = count() by UserName, bin(Timestamp, 5m)
  | where Count > 5000  
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: CTERA
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: false
    matchingMethod: AllEntities
    lookbackDuration: PT5H
  createIncident: true
relevantTechniques:
- T1485
kind: Scheduled
name: CTERA Mass Deletions Detection Analytic
tactics:
- Impact
severity: High
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: UserName
  entityType: Account
- fieldMappings:
  - identifier: Name
    columnName: EdgeFiler
  entityType: File
queryFrequency: 5m
description: This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer
eventGroupingSettings:
  aggregationKind: SingleAlert
triggerThreshold: 5000
triggerOperator: GreaterThan
version: 1.0.0
suppressionEnabled: false
suppressionDuration: PT5H
queryPeriod: 5m
id: 5365f294-0c67-432a-bacf-b1282a3b6c46

ARM