Fortiweb - WAF Allowed threat

Back


Id	86e9409f-b9ea-4e9a-8b72-5132ba43bcae
Rulename	Fortiweb - WAF Allowed threat
Description	Detects WAF “Allowed” action on threat events.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	FortinetFortiWebAma FortiWeb
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml
Version	1.0.1
Arm template	86e9409f-b9ea-4e9a-8b72-5132ba43bcae.json

KQL

Fortiweb
| where EventType =~ 'Attack'
| where DvcAction =~ 'Allow'
| summarize count() by SrcIpAddr

YAML

kind: Scheduled
relevantTechniques:
- T1190
- T1133
description: |
    'Detects WAF "Allowed" action on threat events.'
queryPeriod: 1h
queryFrequency: 1h
tactics:
- InitialAccess
name: Fortiweb - WAF Allowed threat
requiredDataConnectors:
- connectorId: FortiWeb
  dataTypes:
  - Fortiweb
- connectorId: FortinetFortiWebAma
  dataTypes:
  - Fortiweb
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
triggerThreshold: 0
version: 1.0.1
id: 86e9409f-b9ea-4e9a-8b72-5132ba43bcae
query: |
  Fortiweb
  | where EventType =~ 'Attack'
  | where DvcAction =~ 'Allow'
  | summarize count() by SrcIpAddr  
status: Available
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml
severity: High

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/86e9409f-b9ea-4e9a-8b72-5132ba43bcae')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/86e9409f-b9ea-4e9a-8b72-5132ba43bcae')]",
      "properties": {
        "alertRuleTemplateName": "86e9409f-b9ea-4e9a-8b72-5132ba43bcae",
        "customDetails": null,
        "description": "'Detects WAF \"Allowed\" action on threat events.'\n",
        "displayName": "Fortiweb - WAF Allowed threat",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml",
        "query": "Fortiweb\n| where EventType =~ 'Attack'\n| where DvcAction =~ 'Allow'\n| summarize count() by SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}