DDoS Attack IP Addresses - PPS Threshold

Back


Id	6e76fd9d-8104-41eb-bad3-26054a3ad5f0
Rulename	DDoS Attack IP Addresses - PPS Threshold
Description	Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
Severity	Medium
Tactics	Impact
Techniques	T1498
Required data connectors	DDOS
Kind	Scheduled
Query frequency	2h
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml
Version	1.0.1
Arm template	6e76fd9d-8104-41eb-bad3-26054a3ad5f0.json

KQL

AzureDiagnostics 
| where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
//sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
| order by destPublicIpAddress_s, maxPPS desc
| where maxPPS > 10000

YAML

tactics:
- Impact
triggerOperator: gt
requiredDataConnectors:
- connectorId: DDOS
  dataTypes:
  - AzureDiagnostics
relevantTechniques:
- T1498
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: sourcePublicIpAddress_s
  entityType: IP
id: 6e76fd9d-8104-41eb-bad3-26054a3ad5f0
queryPeriod: 2h
name: DDoS Attack IP Addresses - PPS Threshold
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml
queryFrequency: 2h
description: Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
version: 1.0.1
query: |
  AzureDiagnostics 
  | where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
  //sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
  | summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
  | summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
  | order by destPublicIpAddress_s, maxPPS desc
  | where maxPPS > 10000  
triggerThreshold: 0
severity: Medium
status: Available
eventGroupingSettings:
  aggregationKind: SingleAlert
kind: Scheduled

ARM