DDoS Attack IP Addresses - PPS Threshold | Microsoft Sentinel Analytic Rules

Back


Id	6e76fd9d-8104-41eb-bad3-26054a3ad5f0
Rulename	DDoS Attack IP Addresses - PPS Threshold
Description	Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
Severity	Medium
Tactics	Impact
Techniques	T1498
Required data connectors	DDOS
Kind	Scheduled
Query frequency	2h
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20DDoS%20Protection/Analytic%20Rules/AttackSourcesPPSThreshold.yaml
Version	3.2.2
Arm template	6e76fd9d-8104-41eb-bad3-26054a3ad5f0.json

KQL

AzureDiagnostics 
| where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
//sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
| extend destPublicIpAddress_s = coalesce(tostring(column_ifexists("destPublicIpAddress_s", "")), tostring(column_ifexists("AdditionalFields", dynamic({}))["destPublicIpAddress"]), tostring(todynamic(column_ifexists("ResultDescription", ""))["destPublicIpAddress"]))
| extend sourcePublicIpAddress_s = coalesce(tostring(column_ifexists("sourcePublicIpAddress_s", "")), tostring(column_ifexists("AdditionalFields", dynamic({}))["sourcePublicIpAddress"]), tostring(todynamic(column_ifexists("ResultDescription", ""))["sourcePublicIpAddress"]))
| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
| order by destPublicIpAddress_s, maxPPS desc
| where maxPPS > 10000

YAML

entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: sourcePublicIpAddress_s
  entityType: IP
id: 6e76fd9d-8104-41eb-bad3-26054a3ad5f0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20DDoS%20Protection/Analytic%20Rules/AttackSourcesPPSThreshold.yaml
tactics:
- Impact
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - AzureDiagnostics
  connectorId: DDOS
queryPeriod: 2h
eventGroupingSettings:
  aggregationKind: SingleAlert
severity: Medium
relevantTechniques:
- T1498
triggerThreshold: 0
version: 3.2.2
name: DDoS Attack IP Addresses - PPS Threshold
triggerOperator: gt
query: |
  AzureDiagnostics 
  | where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
  //sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
  | extend destPublicIpAddress_s = coalesce(tostring(column_ifexists("destPublicIpAddress_s", "")), tostring(column_ifexists("AdditionalFields", dynamic({}))["destPublicIpAddress"]), tostring(todynamic(column_ifexists("ResultDescription", ""))["destPublicIpAddress"]))
  | extend sourcePublicIpAddress_s = coalesce(tostring(column_ifexists("sourcePublicIpAddress_s", "")), tostring(column_ifexists("AdditionalFields", dynamic({}))["sourcePublicIpAddress"]), tostring(todynamic(column_ifexists("ResultDescription", ""))["sourcePublicIpAddress"]))
  | summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
  | summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
  | order by destPublicIpAddress_s, maxPPS desc
  | where maxPPS > 10000
status: Available
description: Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
queryFrequency: 2h

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6e76fd9d-8104-41eb-bad3-26054a3ad5f0')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6e76fd9d-8104-41eb-bad3-26054a3ad5f0')]",
      "properties": {
        "alertRuleTemplateName": "6e76fd9d-8104-41eb-bad3-26054a3ad5f0",
        "customDetails": null,
        "description": "Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation",
        "displayName": "DDoS Attack IP Addresses - PPS Threshold",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "sourcePublicIpAddress_s",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20DDoS%20Protection/Analytic%20Rules/AttackSourcesPPSThreshold.yaml",
        "query": "AzureDiagnostics \n| where ResourceType == 'PUBLICIPADDRESSES' and Category == \"DDoSMitigationFlowLogs\"\n//sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.\n| extend destPublicIpAddress_s = coalesce(tostring(column_ifexists(\"destPublicIpAddress_s\", \"\")), tostring(column_ifexists(\"AdditionalFields\", dynamic({}))[\"destPublicIpAddress\"]), tostring(todynamic(column_ifexists(\"ResultDescription\", \"\"))[\"destPublicIpAddress\"]))\n| extend sourcePublicIpAddress_s = coalesce(tostring(column_ifexists(\"sourcePublicIpAddress_s\", \"\")), tostring(column_ifexists(\"AdditionalFields\", dynamic({}))[\"sourcePublicIpAddress\"]), tostring(todynamic(column_ifexists(\"ResultDescription\", \"\"))[\"sourcePublicIpAddress\"]))\n| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s\n| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s\n| order by destPublicIpAddress_s, maxPPS desc\n| where maxPPS > 10000\n",
        "queryFrequency": "PT2H",
        "queryPeriod": "PT2H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1498"
        ],
        "templateVersion": "3.2.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}