Contrast ADR - WAF Alert Correlation

ContrastADRAttackEvents_CL
| where result =~ "exploited" or result =~ "blocked"
| project-rename ip=sourceIp
//please add you WAF table in place of ContrastWAFLogs_CL and WAF tables source IP or target IP column's inplace of ip and uncomment the queries below
//| join kind=inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on ip

tactics:
- InitialAccess
- DefenseEvasion
- CommandAndControl
requiredDataConnectors:
- dataTypes:
  - ContrastADRAttackEvents_CL
  connectorId: ContrastADRCCF
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByEntities:
    - IP
    matchingMethod: Selected
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT1H
queryPeriod: 5m
kind: Scheduled
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContrastADR/Analytic%20Rules/Contrast_ADR_Confirmed_WAF.yaml
queryFrequency: 5m
triggerThreshold: 0
description: |
  'Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.'
id: 93641436-afb3-4921-8828-ceab0d15aaab
triggerOperator: gt
alertDetailsOverride:
  alertDescriptionFormat: 'WAF Alert Confirmed {{result}}  by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} '
  alertDisplayNameFormat: 'WAF Alert Confirmed {{result}}  by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} '
status: Available
relevantTechniques:
- T1190
- T1211
- T1008
version: 1.0.1
name: Contrast ADR - WAF Alert Correlation
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: ip
    identifier: Address
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "exploited" or result =~ "blocked"
  | project-rename ip=sourceIp
  //please add you WAF table in place of ContrastWAFLogs_CL and WAF tables source IP or target IP column's inplace of ip and uncomment the queries below
  //| join kind=inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on ip

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/93641436-afb3-4921-8828-ceab0d15aaab')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/93641436-afb3-4921-8828-ceab0d15aaab')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "WAF Alert Confirmed {{result}}  by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} ",
          "alertDisplayNameFormat": "WAF Alert Confirmed {{result}}  by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} "
        },
        "alertRuleTemplateName": "93641436-afb3-4921-8828-ceab0d15aaab",
        "customDetails": null,
        "description": "'Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.'\n",
        "displayName": "Contrast ADR - WAF Alert Correlation",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "ip",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByEntities": [
              "IP"
            ],
            "lookbackDuration": "PT1H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ContrastADR/Analytic%20Rules/Contrast_ADR_Confirmed_WAF.yaml",
        "query": "ContrastADRAttackEvents_CL\n| where result =~ \"exploited\" or result =~ \"blocked\"\n| project-rename ip=sourceIp\n//please add you WAF table in place of ContrastWAFLogs_CL and WAF tables source IP or target IP column's inplace of ip and uncomment the queries below\n//| join kind=inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on ip\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "DefenseEvasion",
          "InitialAccess"
        ],
        "techniques": [
          "T1008",
          "T1190",
          "T1211"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}