CTERA Mass Access Denied Detection Analytic

Back


Id	88341fc3-38e1-46db-8bb1-6c052e749991
Rulename	CTERA Mass Access Denied Detection Analytic
Description	This analytic rule detects and alerts when access denied operations generated by the CTERA Edge Filer goes over a predefined threshold
Severity	High
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	CTERA
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	1000
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassAccessDenied.yaml
Version	1.0.0
Arm template	88341fc3-38e1-46db-8bb1-6c052e749991.json

KQL

Syslog
| where ProcessName == 'gw-audit'
| extend
    TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
    UserName = extract("user=([^|]*)", 1, SyslogMessage),
    Operation = extract("op=([^|]*)", 1, SyslogMessage),
    EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
    RootPath = extract("rootPath=([^|]*)", 1, SyslogMessage),
    Share = extract("share=([^|]*)", 1, SyslogMessage),
    LocalPath = extract("path=([^|]*)", 1, SyslogMessage),
    Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
| where Operation in ('OpenDenied', 'createDenied', 'AclDenied', 'deleteDenied')
| summarize Count = count() by bin(Timestamp, 5m), UserName, EdgeFiler
| where Count > 1000

YAML

suppressionEnabled: false
relevantTechniques:
- T1562
entityMappings:
- fieldMappings:
  - columnName: UserName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: EdgeFiler
    identifier: Name
  entityType: File
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
    lookbackDuration: PT5H
  createIncident: true
version: 1.0.0
triggerThreshold: 1000
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTERA/Analytic Rules/MassAccessDenied.yaml
suppressionDuration: PT5H
description: This analytic rule detects and alerts when access denied operations generated by the CTERA Edge Filer goes over a predefined threshold
customDetails:
  RootPath: RootPath
  Share: Share
  UserName: UserName
  EdgeFiler: EdgeFiler
  TenantName: TenantName
requiredDataConnectors:
- connectorId: CTERA
  dataTypes:
  - Syslog
triggerOperator: GreaterThan
alertDetailsOverride:
  alertnameFormat: CTERA Batch Access Denied Detection
  alertDescriptionFormat: |
        Detected {{Count}} denied access attempts by user {{UserName}} on Edge Filer  {{EdgeFiler}} within 5 minutes. Please investigate unauthorized access attempts or misconfigurations.
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 88341fc3-38e1-46db-8bb1-6c052e749991
queryFrequency: 5m
query: |
  Syslog
  | where ProcessName == 'gw-audit'
  | extend
      TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
      UserName = extract("user=([^|]*)", 1, SyslogMessage),
      Operation = extract("op=([^|]*)", 1, SyslogMessage),
      EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
      RootPath = extract("rootPath=([^|]*)", 1, SyslogMessage),
      Share = extract("share=([^|]*)", 1, SyslogMessage),
      LocalPath = extract("path=([^|]*)", 1, SyslogMessage),
      Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
  | where Operation in ('OpenDenied', 'createDenied', 'AclDenied', 'deleteDenied')
  | summarize Count = count() by bin(Timestamp, 5m), UserName, EdgeFiler
  | where Count > 1000  
severity: High
status: Available
queryPeriod: 5m
name: CTERA Mass Access Denied Detection Analytic
tactics:
- DefenseEvasion
kind: Scheduled

ARM