DDoS Attack IP Addresses - PPS Threshold

Back


Id	6e76fd9d-8104-41eb-bad3-26054a3ad5f0
Rulename	DDoS Attack IP Addresses - PPS Threshold
Description	Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
Severity	Medium
Tactics	Impact
Techniques	T1498
Required data connectors	DDOS
Kind	Scheduled
Query frequency	2h
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml
Version	1.0.1
Arm template	6e76fd9d-8104-41eb-bad3-26054a3ad5f0.json

KQL

AzureDiagnostics 
| where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
//sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
| order by destPublicIpAddress_s, maxPPS desc
| where maxPPS > 10000

YAML

description: Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
kind: Scheduled
tactics:
- Impact
requiredDataConnectors:
- connectorId: DDOS
  dataTypes:
  - AzureDiagnostics
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml
severity: Medium
name: DDoS Attack IP Addresses - PPS Threshold
triggerThreshold: 0
queryPeriod: 2h
query: |
  AzureDiagnostics 
  | where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
  //sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
  | summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
  | summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
  | order by destPublicIpAddress_s, maxPPS desc
  | where maxPPS > 10000  
relevantTechniques:
- T1498
id: 6e76fd9d-8104-41eb-bad3-26054a3ad5f0
queryFrequency: 2h
status: Available
version: 1.0.1
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: sourcePublicIpAddress_s
    identifier: Address

ARM