Fortiweb - WAF Allowed threat

Back


Id	86e9409f-b9ea-4e9a-8b72-5132ba43bcae
Rulename	Fortiweb - WAF Allowed threat
Description	Detects WAF “Allowed” action on threat events.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	FortinetFortiWebAma FortiWeb
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml
Version	1.0.1
Arm template	86e9409f-b9ea-4e9a-8b72-5132ba43bcae.json

KQL

Fortiweb
| where EventType =~ 'Attack'
| where DvcAction =~ 'Allow'
| summarize count() by SrcIpAddr

YAML

kind: Scheduled
queryPeriod: 1h
description: |
    'Detects WAF "Allowed" action on threat events.'
tactics:
- InitialAccess
id: 86e9409f-b9ea-4e9a-8b72-5132ba43bcae
requiredDataConnectors:
- connectorId: FortiWeb
  dataTypes:
  - Fortiweb
- connectorId: FortinetFortiWebAma
  dataTypes:
  - Fortiweb
relevantTechniques:
- T1190
- T1133
severity: High
version: 1.0.1
status: Available
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
name: Fortiweb - WAF Allowed threat
triggerOperator: gt
query: |
  Fortiweb
  | where EventType =~ 'Attack'
  | where DvcAction =~ 'Allow'
  | summarize count() by SrcIpAddr  
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml
triggerThreshold: 0

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/86e9409f-b9ea-4e9a-8b72-5132ba43bcae')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/86e9409f-b9ea-4e9a-8b72-5132ba43bcae')]",
      "properties": {
        "alertRuleTemplateName": "86e9409f-b9ea-4e9a-8b72-5132ba43bcae",
        "customDetails": null,
        "description": "'Detects WAF \"Allowed\" action on threat events.'\n",
        "displayName": "Fortiweb - WAF Allowed threat",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Fortinet FortiWeb Cloud WAF-as-a-Service connector for Microsoft Sentinel/Analytic Rules/Fortiweb - WAF Allowed threat.yaml",
        "query": "Fortiweb\n| where EventType =~ 'Attack'\n| where DvcAction =~ 'Allow'\n| summarize count() by SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}