Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

DDoS Attack IP Addresses - PPS Threshold

Back
Id6e76fd9d-8104-41eb-bad3-26054a3ad5f0
RulenameDDoS Attack IP Addresses - PPS Threshold
DescriptionIdentifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
SeverityMedium
TacticsImpact
TechniquesT1498
Required data connectorsDDOS
KindScheduled
Query frequency2h
Query period2h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml
Version1.0.1
Arm template6e76fd9d-8104-41eb-bad3-26054a3ad5f0.json
Deploy To Azure
AzureDiagnostics 
| where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
//sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
| order by destPublicIpAddress_s, maxPPS desc
| where maxPPS > 10000
eventGroupingSettings:
  aggregationKind: SingleAlert
status: Available
triggerThreshold: 0
relevantTechniques:
- T1498
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml
requiredDataConnectors:
- dataTypes:
  - AzureDiagnostics
  connectorId: DDOS
queryPeriod: 2h
tactics:
- Impact
severity: Medium
kind: Scheduled
description: Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
query: |
  AzureDiagnostics 
  | where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
  //sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
  | summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
  | summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
  | order by destPublicIpAddress_s, maxPPS desc
  | where maxPPS > 10000  
name: DDoS Attack IP Addresses - PPS Threshold
version: 1.0.1
id: 6e76fd9d-8104-41eb-bad3-26054a3ad5f0
triggerOperator: gt
queryFrequency: 2h
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: sourcePublicIpAddress_s
    identifier: Address
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6e76fd9d-8104-41eb-bad3-26054a3ad5f0')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6e76fd9d-8104-41eb-bad3-26054a3ad5f0')]",
      "properties": {
        "alertRuleTemplateName": "6e76fd9d-8104-41eb-bad3-26054a3ad5f0",
        "customDetails": null,
        "description": "Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation",
        "displayName": "DDoS Attack IP Addresses - PPS Threshold",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "sourcePublicIpAddress_s",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure DDoS Protection/Analytic Rules/AttackSourcesPPSThreshold.yaml",
        "query": "AzureDiagnostics \n| where ResourceType == 'PUBLICIPADDRESSES' and Category == \"DDoSMitigationFlowLogs\"\n//sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.\n| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s\n| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s\n| order by destPublicIpAddress_s, maxPPS desc\n| where maxPPS > 10000\n",
        "queryFrequency": "PT2H",
        "queryPeriod": "PT2H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1498"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}