Fortiweb - WAF Allowed threat

Back


Id	86e9409f-b9ea-4e9a-8b72-5132ba43bcae
Rulename	Fortiweb - WAF Allowed threat
Description	Detects WAF “Allowed” action on threat events.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	FortinetFortiWebAma FortiWeb
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml
Version	1.0.1
Arm template	86e9409f-b9ea-4e9a-8b72-5132ba43bcae.json

KQL

Fortiweb
| where EventType =~ 'Attack'
| where DvcAction =~ 'Allow'
| summarize count() by SrcIpAddr

YAML

relevantTechniques:
- T1190
- T1133
name: Fortiweb - WAF Allowed threat
requiredDataConnectors:
- dataTypes:
  - Fortiweb
  connectorId: FortiWeb
- dataTypes:
  - Fortiweb
  connectorId: FortinetFortiWebAma
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
triggerThreshold: 0
id: 86e9409f-b9ea-4e9a-8b72-5132ba43bcae
tactics:
- InitialAccess
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml
queryPeriod: 1h
kind: Scheduled
queryFrequency: 1h
severity: High
status: Available
description: |
    'Detects WAF "Allowed" action on threat events.'
query: |
  Fortiweb
  | where EventType =~ 'Attack'
  | where DvcAction =~ 'Allow'
  | summarize count() by SrcIpAddr  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/86e9409f-b9ea-4e9a-8b72-5132ba43bcae')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/86e9409f-b9ea-4e9a-8b72-5132ba43bcae')]",
      "properties": {
        "alertRuleTemplateName": "86e9409f-b9ea-4e9a-8b72-5132ba43bcae",
        "customDetails": null,
        "description": "'Detects WAF \"Allowed\" action on threat events.'\n",
        "displayName": "Fortiweb - WAF Allowed threat",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml",
        "query": "Fortiweb\n| where EventType =~ 'Attack'\n| where DvcAction =~ 'Allow'\n| summarize count() by SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}