Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Tomcat - Server errors after multiple requests from same IP

Back
Id875da588-4875-11ec-81d3-0242ac130003
RulenameTomcat - Server errors after multiple requests from same IP
DescriptionDetects server errors after multiple requests from same IP address.
SeverityMedium
TacticsImpact
InitialAccess
TechniquesT1498
T1190
T1133
Required data connectorsCustomLogsAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatServerErrorsAfterMultipleRequestsFromSameIP.yaml
Version1.0.2
Arm template875da588-4875-11ec-81d3-0242ac130003.json
Deploy To Azure
let multi_errors = TomcatEvent
| where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
| sort by EventStartTime asc
| summarize MultipleServerErrors = count() by SrcIpAddr, bin(EventStartTime, 5m)
| where MultipleServerErrors > 10;
let error_time_table = TomcatEvent
| where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
| summarize error_time=min(EventStartTime) by SrcIpAddr
| join kind=innerunique (multi_errors) on SrcIpAddr;
TomcatEvent
| where toint(HttpStatusCode) >= 100 and toint(HttpStatusCode) <= 399
| summarize success_time=max(EventStartTime) by SrcIpAddr
| join kind=innerunique (error_time_table) on SrcIpAddr
| extend time_between_error_and_success = datetime_diff('second', error_time, success_time)
| where time_between_error_and_success between (1 .. 300)
| project time_between_error_and_success, error_time, success_time, SrcIpAddr
| extend IPCustomEntity = SrcIpAddr
triggerThreshold: 0
requiredDataConnectors:
- connectorId: CustomLogsAma
  datatypes:
  - Tomcat_CL
severity: Medium
queryFrequency: 1h
id: 875da588-4875-11ec-81d3-0242ac130003
relevantTechniques:
- T1498
- T1190
- T1133
queryPeriod: 1h
name: Tomcat - Server errors after multiple requests from same IP
status: Available
kind: Scheduled
tactics:
- Impact
- InitialAccess
triggerOperator: gt
version: 1.0.2
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
description: |
    'Detects server errors after multiple requests from same IP address.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatServerErrorsAfterMultipleRequestsFromSameIP.yaml
query: |
  let multi_errors = TomcatEvent
  | where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
  | sort by EventStartTime asc
  | summarize MultipleServerErrors = count() by SrcIpAddr, bin(EventStartTime, 5m)
  | where MultipleServerErrors > 10;
  let error_time_table = TomcatEvent
  | where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599
  | summarize error_time=min(EventStartTime) by SrcIpAddr
  | join kind=innerunique (multi_errors) on SrcIpAddr;
  TomcatEvent
  | where toint(HttpStatusCode) >= 100 and toint(HttpStatusCode) <= 399
  | summarize success_time=max(EventStartTime) by SrcIpAddr
  | join kind=innerunique (error_time_table) on SrcIpAddr
  | extend time_between_error_and_success = datetime_diff('second', error_time, success_time)
  | where time_between_error_and_success between (1 .. 300)
  | project time_between_error_and_success, error_time, success_time, SrcIpAddr
  | extend IPCustomEntity = SrcIpAddr  
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/875da588-4875-11ec-81d3-0242ac130003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/875da588-4875-11ec-81d3-0242ac130003')]",
      "properties": {
        "alertRuleTemplateName": "875da588-4875-11ec-81d3-0242ac130003",
        "customDetails": null,
        "description": "'Detects server errors after multiple requests from same IP address.'\n",
        "displayName": "Tomcat - Server errors after multiple requests from same IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tomcat/Analytic Rules/TomcatServerErrorsAfterMultipleRequestsFromSameIP.yaml",
        "query": "let multi_errors = TomcatEvent\n| where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599\n| sort by EventStartTime asc\n| summarize MultipleServerErrors = count() by SrcIpAddr, bin(EventStartTime, 5m)\n| where MultipleServerErrors > 10;\nlet error_time_table = TomcatEvent\n| where toint(HttpStatusCode) >= 500 and toint(HttpStatusCode) <= 599\n| summarize error_time=min(EventStartTime) by SrcIpAddr\n| join kind=innerunique (multi_errors) on SrcIpAddr;\nTomcatEvent\n| where toint(HttpStatusCode) >= 100 and toint(HttpStatusCode) <= 399\n| summarize success_time=max(EventStartTime) by SrcIpAddr\n| join kind=innerunique (error_time_table) on SrcIpAddr\n| extend time_between_error_and_success = datetime_diff('second', error_time, success_time)\n| where time_between_error_and_success between (1 .. 300)\n| project time_between_error_and_success, error_time, success_time, SrcIpAddr\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190",
          "T1498"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}