Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

DDoS Attack IP Addresses - PPS Threshold

Back
Id6e76fd9d-8104-41eb-bad3-26054a3ad5f0
RulenameDDoS Attack IP Addresses - PPS Threshold
DescriptionIdentifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
SeverityMedium
TacticsImpact
TechniquesT1498
Required data connectorsDDOS
KindScheduled
Query frequency2h
Query period2h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml
Version1.0.1
Arm template6e76fd9d-8104-41eb-bad3-26054a3ad5f0.json
Deploy To Azure
AzureDiagnostics 
| where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
//sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
| order by destPublicIpAddress_s, maxPPS desc
| where maxPPS > 10000
version: 1.0.1
status: Available
queryFrequency: 2h
requiredDataConnectors:
- connectorId: DDOS
  dataTypes:
  - AzureDiagnostics
entityMappings:
- fieldMappings:
  - columnName: sourcePublicIpAddress_s
    identifier: Address
  entityType: IP
kind: Scheduled
queryPeriod: 2h
severity: Medium
query: |
  AzureDiagnostics 
  | where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
  //sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
  | summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
  | summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
  | order by destPublicIpAddress_s, maxPPS desc
  | where maxPPS > 10000  
eventGroupingSettings:
  aggregationKind: SingleAlert
triggerOperator: gt
id: 6e76fd9d-8104-41eb-bad3-26054a3ad5f0
description: Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
triggerThreshold: 0
name: DDoS Attack IP Addresses - PPS Threshold
relevantTechniques:
- T1498
tactics:
- Impact
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6e76fd9d-8104-41eb-bad3-26054a3ad5f0')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6e76fd9d-8104-41eb-bad3-26054a3ad5f0')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "DDoS Attack IP Addresses - PPS Threshold",
        "description": "Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation",
        "severity": "Medium",
        "enabled": true,
        "query": "AzureDiagnostics \n| where ResourceType == 'PUBLICIPADDRESSES' and Category == \"DDoSMitigationFlowLogs\"\n//sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.\n| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s\n| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s\n| order by destPublicIpAddress_s, maxPPS desc\n| where maxPPS > 10000\n",
        "queryFrequency": "PT2H",
        "queryPeriod": "PT2H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1498"
        ],
        "alertRuleTemplateName": "6e76fd9d-8104-41eb-bad3-26054a3ad5f0",
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "customDetails": null,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "sourcePublicIpAddress_s"
              }
            ]
          }
        ],
        "status": "Available",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml",
        "templateVersion": "1.0.1"
      }
    }
  ]
}