CTERA Mass Deletions Detection Analytic

Back


Id	5365f294-0c67-432a-bacf-b1282a3b6c46
Rulename	CTERA Mass Deletions Detection Analytic
Description	This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer
Severity	High
Tactics	Impact
Techniques	T1485
Required data connectors	CTERA
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	5000
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassDeletions.yaml
Version	1.0.0
Arm template	5365f294-0c67-432a-bacf-b1282a3b6c46.json

KQL

Syslog
| where ProcessName == 'gw-audit'
| extend
    TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
    UserName = extract("user=([^|]*)", 1, SyslogMessage),
    Permission = extract("op=([^|]*)", 1, SyslogMessage),
    EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
    RootPath = extract("rootPath=([^|]*)", 1, SyslogMessage),
    Share = extract("share=([^|]*)", 1, SyslogMessage),
    LocalPath = extract("path=([^|]*)", 1, SyslogMessage),
    Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
| where Permission == 'delete'
| summarize Count = count() by UserName, bin(Timestamp, 5m)
| where Count > 5000

YAML

name: CTERA Mass Deletions Detection Analytic
relevantTechniques:
- T1485
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassDeletions.yaml
queryPeriod: 5m
version: 1.0.0
kind: Scheduled
id: 5365f294-0c67-432a-bacf-b1282a3b6c46
triggerOperator: GreaterThan
triggerThreshold: 5000
customDetails:
  RootPath: RootPath
  TenantName: TenantName
  EdgeFiler: EdgeFiler
  UserName: UserName
  Share: Share
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: CTERA
eventGroupingSettings:
  aggregationKind: SingleAlert
suppressionDuration: PT5H
severity: High
suppressionEnabled: false
description: This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer
alertDetailsOverride:
  alertDescriptionFormat: |
        Detected {{Count}} denied access attempts by user {{UserName}} on Edge Filer  {{EdgeFiler}} within 5 minutes. Please investigate unauthorized access attempts or misconfigurations.
  alertnameFormat: CTERA Batch Access Denied Detection
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserName
    identifier: Name
- entityType: File
  fieldMappings:
  - columnName: EdgeFiler
    identifier: Name
query: |
  Syslog
  | where ProcessName == 'gw-audit'
  | extend
      TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
      UserName = extract("user=([^|]*)", 1, SyslogMessage),
      Permission = extract("op=([^|]*)", 1, SyslogMessage),
      EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
      RootPath = extract("rootPath=([^|]*)", 1, SyslogMessage),
      Share = extract("share=([^|]*)", 1, SyslogMessage),
      LocalPath = extract("path=([^|]*)", 1, SyslogMessage),
      Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
  | where Permission == 'delete'
  | summarize Count = count() by UserName, bin(Timestamp, 5m)
  | where Count > 5000  
tactics:
- Impact
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    enabled: false
status: Available
queryFrequency: 5m

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5365f294-0c67-432a-bacf-b1282a3b6c46')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5365f294-0c67-432a-bacf-b1282a3b6c46')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Detected {{Count}} denied access attempts by user {{UserName}} on Edge Filer  {{EdgeFiler}} within 5 minutes. Please investigate unauthorized access attempts or misconfigurations.\n",
          "alertnameFormat": "CTERA Batch Access Denied Detection"
        },
        "alertRuleTemplateName": "5365f294-0c67-432a-bacf-b1282a3b6c46",
        "customDetails": {
          "EdgeFiler": "EdgeFiler",
          "RootPath": "RootPath",
          "Share": "Share",
          "TenantName": "TenantName",
          "UserName": "UserName"
        },
        "description": "This analytic rule detects and alerts when large amount of deletion operations generated by the CTERA Edge Filer",
        "displayName": "CTERA Mass Deletions Detection Analytic",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "File",
            "fieldMappings": [
              {
                "columnName": "EdgeFiler",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassDeletions.yaml",
        "query": "Syslog\n| where ProcessName == 'gw-audit'\n| extend\n    TenantName = extract(\"\\\"vportal\\\":\\\"([^\\\"]*)\\\"\", 1, SyslogMessage),\n    UserName = extract(\"user=([^|]*)\", 1, SyslogMessage),\n    Permission = extract(\"op=([^|]*)\", 1, SyslogMessage),\n    EdgeFiler = extract(\"\\\"client\\\":\\\"([^\\\"]*)\\\"\", 1, SyslogMessage),\n    RootPath = extract(\"rootPath=([^|]*)\", 1, SyslogMessage),\n    Share = extract(\"share=([^|]*)\", 1, SyslogMessage),\n    LocalPath = extract(\"path=([^|]*)\", 1, SyslogMessage),\n    Timestamp = todatetime(extract(\"\\\"@timestamp\\\":\\\"([^\\\"]*)\\\"\", 1, SyslogMessage))\n| where Permission == 'delete'\n| summarize Count = count() by UserName, bin(Timestamp, 5m)\n| where Count > 5000\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1485"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 5000
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}