Fortiweb - WAF Allowed threat

Back


Id	86e9409f-b9ea-4e9a-8b72-5132ba43bcae
Rulename	Fortiweb - WAF Allowed threat
Description	Detects WAF “Allowed” action on threat events.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	FortinetFortiWebAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml
Version	1.0.2
Arm template	86e9409f-b9ea-4e9a-8b72-5132ba43bcae.json

KQL

Fortiweb
| where EventType =~ 'Attack'
| where DvcAction =~ 'Allow'
| summarize count() by SrcIpAddr

YAML

queryPeriod: 1h
query: |
  Fortiweb
  | where EventType =~ 'Attack'
  | where DvcAction =~ 'Allow'
  | summarize count() by SrcIpAddr  
name: Fortiweb - WAF Allowed threat
entityMappings:
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml
requiredDataConnectors:
- connectorId: FortinetFortiWebAma
  dataTypes:
  - Fortiweb
description: |
    'Detects WAF "Allowed" action on threat events.'
kind: Scheduled
version: 1.0.2
status: Available
severity: High
relevantTechniques:
- T1190
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
id: 86e9409f-b9ea-4e9a-8b72-5132ba43bcae

ARM