Contrast ADR - WAF Alert Correlation

Back


Id	93641436-afb3-4921-8828-ceab0d15aaab
Rulename	Contrast ADR - WAF Alert Correlation
Description	Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.
Severity	Medium
Tactics	InitialAccess DefenseEvasion CommandAndControl
Techniques	T1190 T1211 T1008
Required data connectors	ContrastADR
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContrastADR/Analytic Rules/Contrast_ADR_Confirmed_WAF.yaml
Version	1.0.0
Arm template	93641436-afb3-4921-8828-ceab0d15aaab.json

KQL

ContrastADR_CL
| where result_s =~ "exploited" or result_s =~ "blocked"
| project-rename ip_s=SourceIP
//please add you WAF table in place of ContrastWAFLogs_CL and WAF tables source IP or target IP column's inplace of ip_s and uncomment the queries below
//| join kind=inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on ip_s

YAML

severity: Medium
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryPeriod: 5m
name: Contrast ADR - WAF Alert Correlation
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContrastADR/Analytic Rules/Contrast_ADR_Confirmed_WAF.yaml
entityMappings:
- fieldMappings:
  - columnName: SourceIP
    identifier: Address
  entityType: IP
alertDetailsOverride:
  alertDescriptionFormat: 'WAF Alert Confirmed {{result_s}}  by Contrast ADR on {{request_headers_referer_s}}  endpoint of {{application_name_s}} '
  alertDisplayNameFormat: 'WAF Alert Confirmed {{result_s}}  by Contrast ADR on {{request_headers_referer_s}}  endpoint of {{application_name_s}} '
version: 1.0.0
relevantTechniques:
- T1190
- T1211
- T1008
status: Available
id: 93641436-afb3-4921-8828-ceab0d15aaab
queryFrequency: 5m
triggerThreshold: 0
triggerOperator: gt
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    matchingMethod: Selected
    lookbackDuration: PT1H
  createIncident: true
query: |
  ContrastADR_CL
  | where result_s =~ "exploited" or result_s =~ "blocked"
  | project-rename ip_s=SourceIP
  //please add you WAF table in place of ContrastWAFLogs_CL and WAF tables source IP or target IP column's inplace of ip_s and uncomment the queries below
  //| join kind=inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on ip_s  
description: |
    'Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.'
requiredDataConnectors:
- connectorId: ContrastADR
  dataTypes:
  - ContrastADR_CL
tactics:
- InitialAccess
- DefenseEvasion
- CommandAndControl
kind: Scheduled

ARM