Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

NGINX - Multiple user agents for single source

Back
Id83a0b48f-1cb7-4b4f-a018-23c3203a239b
RulenameNGINX - Multiple user agents for single source
DescriptionDetects requests with different user agents from one source in short timeframe.
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsCustomLogsAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXDifferentUAsFromSingleIP.yaml
Version1.0.2
Arm template83a0b48f-1cb7-4b4f-a018-23c3203a239b.json
Deploy To Azure
let threshold = 5;
NGINXHTTPServer
| summarize makeset(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
| extend ua_count = array_length(set_HttpUserAgentOriginal)
| where ua_count > threshold
| extend IPCustomEntity = SrcIpAddr
severity: Medium
relevantTechniques:
- T1190
- T1133
requiredDataConnectors:
- dataTypes:
  - NGINX_CL
  connectorId: CustomLogsAma
status: Available
triggerThreshold: 0
description: |
    'Detects requests with different user agents from one source in short timeframe.'
triggerOperator: gt
name: NGINX - Multiple user agents for single source
queryFrequency: 1h
version: 1.0.2
query: |
  let threshold = 5;
  NGINXHTTPServer
  | summarize makeset(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)
  | extend ua_count = array_length(set_HttpUserAgentOriginal)
  | where ua_count > threshold
  | extend IPCustomEntity = SrcIpAddr  
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
tactics:
- InitialAccess
queryPeriod: 1h
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXDifferentUAsFromSingleIP.yaml
id: 83a0b48f-1cb7-4b4f-a018-23c3203a239b
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/83a0b48f-1cb7-4b4f-a018-23c3203a239b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/83a0b48f-1cb7-4b4f-a018-23c3203a239b')]",
      "properties": {
        "alertRuleTemplateName": "83a0b48f-1cb7-4b4f-a018-23c3203a239b",
        "customDetails": null,
        "description": "'Detects requests with different user agents from one source in short timeframe.'\n",
        "displayName": "NGINX - Multiple user agents for single source",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXDifferentUAsFromSingleIP.yaml",
        "query": "let threshold = 5;\nNGINXHTTPServer\n| summarize makeset(HttpUserAgentOriginal) by SrcIpAddr, bin(TimeGenerated, 5m)\n| extend ua_count = array_length(set_HttpUserAgentOriginal)\n| where ua_count > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}