Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Tomcat - Multiple empty requests from same IP

Back
Id7c9a1026-4872-11ec-81d3-0242ac130003
RulenameTomcat - Multiple empty requests from same IP
DescriptionDetects multiple empty requests from same IP
SeverityMedium
TacticsInitialAccess
Impact
TechniquesT1190
T1133
T1499
Required data connectorsApacheTomcat
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatMultipleEmptyRequestsFromSameIP.yaml
Version1.0.0
Arm template7c9a1026-4872-11ec-81d3-0242ac130003.json
Deploy To Azure
let threshold = 50;
TomcatEvent
| where HttpResponseBodyBytes == 0
| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
| where MultipleClientErrors > threshold
| extend IPCustomEntity = SrcIpAddr
triggerOperator: gt
version: 1.0.0
query: |
  let threshold = 50;
  TomcatEvent
  | where HttpResponseBodyBytes == 0
  | summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)
  | where MultipleClientErrors > threshold
  | extend IPCustomEntity = SrcIpAddr  
status: Available
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatMultipleEmptyRequestsFromSameIP.yaml
queryFrequency: 1h
requiredDataConnectors:
- connectorId: ApacheTomcat
  dataTypes:
  - TomcatEvent
name: Tomcat - Multiple empty requests from same IP
queryPeriod: 1h
severity: Medium
kind: Scheduled
tactics:
- InitialAccess
- Impact
id: 7c9a1026-4872-11ec-81d3-0242ac130003
description: |
    'Detects multiple empty requests from same IP'
relevantTechniques:
- T1190
- T1133
- T1499
triggerThreshold: 0
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7c9a1026-4872-11ec-81d3-0242ac130003')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7c9a1026-4872-11ec-81d3-0242ac130003')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Tomcat - Multiple empty requests from same IP",
        "description": "'Detects multiple empty requests from same IP'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let threshold = 50;\nTomcatEvent\n| where HttpResponseBodyBytes == 0\n| summarize MultipleClientErrors = count() by SrcIpAddr, bin(TimeGenerated, 5m)\n| where MultipleClientErrors > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "Impact"
        ],
        "techniques": [
          "T1190",
          "T1133",
          "T1499"
        ],
        "alertRuleTemplateName": "7c9a1026-4872-11ec-81d3-0242ac130003",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatMultipleEmptyRequestsFromSameIP.yaml",
        "status": "Available",
        "templateVersion": "1.0.0"
      }
    }
  ]
}