Cyren High-Risk IP Indicators | Microsoft Sentinel Analytic Rules

Back


Id	5d7e8b3a-1f2c-4e5d-9a0b-c1d2e3f4a5b6
Rulename	Cyren High-Risk IP Indicators
Description	Detects high-risk IP indicators (risk score >= 80) from Cyren threat intelligence feeds in the last 24 hours. These IPs are associated with malicious activity such as malware distribution, phishing, or botnet command and control.
Severity	High
Tactics	CommandAndControl Impact
Techniques	T1071 T1568
Required data connectors	CyrenThreatIntel
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyrenThreatIntelligence/Analytic%20Rules/Cyren%20-%20High%20Risk%20IP%20Indicators.yaml
Version	1.0.0
Arm template	5d7e8b3a-1f2c-4e5d-9a0b-c1d2e3f4a5b6.json

KQL

Cyren_Indicators_CL
| where TimeGenerated > ago(1d)
| where isnotempty(ip_s)
| extend Risk = toint(risk_d)
| where Risk >= 80
| summarize 
    DetectionCount = count(), 
    MaxRisk = max(Risk), 
    Categories = make_set(category_s) 
  by IP = ip_s, Source = source_s
| where DetectionCount >= 1
| extend 
    IPAddress = IP,
    ThreatCategories = strcat_array(Categories, ", ")

YAML

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    groupByEntities:
    - IP
    matchingMethod: Selected
    enabled: true
    lookbackDuration: 1d
suppressionEnabled: false
triggerThreshold: 0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyrenThreatIntelligence/Analytic%20Rules/Cyren%20-%20High%20Risk%20IP%20Indicators.yaml
requiredDataConnectors:
- connectorId: CyrenThreatIntel
  dataTypes:
  - Cyren_Indicators_CL
id: 5d7e8b3a-1f2c-4e5d-9a0b-c1d2e3f4a5b6
relevantTechniques:
- T1071
- T1568
entityMappings:
- fieldMappings:
  - columnName: IPAddress
    identifier: Address
  entityType: IP
version: 1.0.0
severity: High
query: |
  Cyren_Indicators_CL
  | where TimeGenerated > ago(1d)
  | where isnotempty(ip_s)
  | extend Risk = toint(risk_d)
  | where Risk >= 80
  | summarize 
      DetectionCount = count(), 
      MaxRisk = max(Risk), 
      Categories = make_set(category_s) 
    by IP = ip_s, Source = source_s
  | where DetectionCount >= 1
  | extend 
      IPAddress = IP,
      ThreatCategories = strcat_array(Categories, ", ")
description: |
  'Detects high-risk IP indicators (risk score >= 80) from Cyren threat intelligence feeds in the last 24 hours.
  These IPs are associated with malicious activity such as malware distribution, phishing, or botnet command and control.'
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available
customDetails:
  RiskScore: MaxRisk
  DetectionCount: DetectionCount
  Source: Source
  Categories: ThreatCategories
queryFrequency: 1h
kind: Scheduled
name: Cyren High-Risk IP Indicators
queryPeriod: 1d
tactics:
- CommandAndControl
- Impact
suppressionDuration: 1h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5d7e8b3a-1f2c-4e5d-9a0b-c1d2e3f4a5b6')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5d7e8b3a-1f2c-4e5d-9a0b-c1d2e3f4a5b6')]",
      "properties": {
        "alertRuleTemplateName": "5d7e8b3a-1f2c-4e5d-9a0b-c1d2e3f4a5b6",
        "customDetails": {
          "Categories": "ThreatCategories",
          "DetectionCount": "DetectionCount",
          "RiskScore": "MaxRisk",
          "Source": "Source"
        },
        "description": "'Detects high-risk IP indicators (risk score >= 80) from Cyren threat intelligence feeds in the last 24 hours.\nThese IPs are associated with malicious activity such as malware distribution, phishing, or botnet command and control.'\n",
        "displayName": "Cyren High-Risk IP Indicators",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "IP"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyrenThreatIntelligence/Analytic%20Rules/Cyren%20-%20High%20Risk%20IP%20Indicators.yaml",
        "query": "Cyren_Indicators_CL\n| where TimeGenerated > ago(1d)\n| where isnotempty(ip_s)\n| extend Risk = toint(risk_d)\n| where Risk >= 80\n| summarize \n    DetectionCount = count(), \n    MaxRisk = max(Risk), \n    Categories = make_set(category_s) \n  by IP = ip_s, Source = source_s\n| where DetectionCount >= 1\n| extend \n    IPAddress = IP,\n    ThreatCategories = strcat_array(Categories, \", \")\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "Impact"
        ],
        "techniques": [
          "T1071",
          "T1568"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}