Tomcat - Server errors after multiple requests from same IP

Back


Id	875da588-4875-11ec-81d3-0242ac130003
Rulename	Tomcat - Server errors after multiple requests from same IP
Description	Detects server errors after multiple requests from same IP address.
Severity	Medium
Tactics	Impact InitialAccess
Techniques	T1498 T1190 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatServerErrorsAfterMultipleRequestsFromSameIP.yaml
Version	1.0.2
Arm template	875da588-4875-11ec-81d3-0242ac130003.json

KQL

let multi_errors = TomcatEvent
| where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
| sort by EventStartTime asc
| summarize MultipleServerErrors = count() by SrcIpAddr, bin(EventStartTime, 5m)
| where MultipleServerErrors > 10;
let error_time_table = TomcatEvent
| where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
| summarize error_time=min(EventStartTime) by SrcIpAddr
| join kind=innerunique (multi_errors) on SrcIpAddr;
TomcatEvent
| where toint(HttpStatusCode) >= 100 and toint(HttpStatusCode) <= 399
| summarize success_time=max(EventStartTime) by SrcIpAddr
| join kind=innerunique (error_time_table) on SrcIpAddr
| extend time_between_error_and_success = datetime_diff('second', error_time, success_time)
| where time_between_error_and_success between (1 .. 300)
| project time_between_error_and_success, error_time, success_time, SrcIpAddr
| extend IPCustomEntity = SrcIpAddr

YAML

queryPeriod: 1h
query: |
  let multi_errors = TomcatEvent
  | where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
  | sort by EventStartTime asc
  | summarize MultipleServerErrors = count() by SrcIpAddr, bin(EventStartTime, 5m)
  | where MultipleServerErrors > 10;
  let error_time_table = TomcatEvent
  | where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
  | summarize error_time=min(EventStartTime) by SrcIpAddr
  | join kind=innerunique (multi_errors) on SrcIpAddr;
  TomcatEvent
  | where toint(HttpStatusCode) >= 100 and toint(HttpStatusCode) <= 399
  | summarize success_time=max(EventStartTime) by SrcIpAddr
  | join kind=innerunique (error_time_table) on SrcIpAddr
  | extend time_between_error_and_success = datetime_diff('second', error_time, success_time)
  | where time_between_error_and_success between (1 .. 300)
  | project time_between_error_and_success, error_time, success_time, SrcIpAddr
  | extend IPCustomEntity = SrcIpAddr  
name: Tomcat - Server errors after multiple requests from same IP
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatServerErrorsAfterMultipleRequestsFromSameIP.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - Tomcat_CL
description: |
    'Detects server errors after multiple requests from same IP address.'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1498
- T1190
- T1133
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- InitialAccess
id: 875da588-4875-11ec-81d3-0242ac130003

ARM