Cisco Umbrella - Rare User Agent Detected

Back


Id	8c8de3fa-6425-4623-9cd9-45de1dd0569a
Rulename	Cisco Umbrella - Rare User Agent Detected
Description	Rule helps to detect a rare user-agents indicating web browsing activity by an unusual process other than a web browser.
Severity	Medium
Tactics	CommandAndControl
Required data connectors	CiscoUmbrellaDataConnector
Kind	Scheduled
Query frequency	1d
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaRareUserAgentDetected.yaml
Version	1.1.2
Arm template	8c8de3fa-6425-4623-9cd9-45de1dd0569a.json

KQL

let lookBack = 14d;
let timeframe = 1d;
let user_agents_list = Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(lookBack) and TimeGenerated < ago(timeframe)
| summarize count() by HttpUserAgentOriginal
| summarize make_list(HttpUserAgentOriginal);
Cisco_Umbrella
| where EventType == "proxylogs"
| where TimeGenerated > ago(timeframe)
| where HttpUserAgentOriginal !in (user_agents_list)
| extend Message = "Rare User Agent"
| project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated, HttpUserAgentOriginal

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaRareUserAgentDetected.yaml
requiredDataConnectors:
- dataTypes:
  - Cisco_Umbrella_proxy_CL
  connectorId: CiscoUmbrellaDataConnector
name: Cisco Umbrella - Rare User Agent Detected
entityMappings:
- fieldMappings:
  - columnName: UrlOriginal
    identifier: Url
  entityType: URL
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
id: 8c8de3fa-6425-4623-9cd9-45de1dd0569a
description: |
    'Rule helps to detect a rare user-agents indicating web browsing activity by an unusual process other than a web browser.'
tactics:
- CommandAndControl
triggerThreshold: 0
kind: Scheduled
query: |
  let lookBack = 14d;
  let timeframe = 1d;
  let user_agents_list = Cisco_Umbrella
  | where EventType == "proxylogs"
  | where TimeGenerated > ago(lookBack) and TimeGenerated < ago(timeframe)
  | summarize count() by HttpUserAgentOriginal
  | summarize make_list(HttpUserAgentOriginal);
  Cisco_Umbrella
  | where EventType == "proxylogs"
  | where TimeGenerated > ago(timeframe)
  | where HttpUserAgentOriginal !in (user_agents_list)
  | extend Message = "Rare User Agent"
  | project Message, SrcIpAddr, DstIpAddr, UrlOriginal, TimeGenerated, HttpUserAgentOriginal  
triggerOperator: gt
queryPeriod: 14d
queryFrequency: 1d
version: 1.1.2
severity: Medium

ARM