Cisco SDWAN - Monitor Critical IPs

Back


Id	a62a207e-62be-4a74-acab-4466d5b3854f
Rulename	Cisco SDWAN - Monitor Critical IPs
Description	This analytic rule will monitor critical IPs in Syslog and Netflow Data.
Severity	High
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	CiscoSDWAN
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
Version	1.0.1
Arm template	a62a207e-62be-4a74-acab-4466d5b3854f.json

KQL

CiscoSyslogUTD
| union (CiscoSDWANNetflow)
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
| summarize count() by SourceIP

YAML

relevantTechniques:
- T1071
entityMappings:
- fieldMappings:
  - columnName: SourceIP
    identifier: Address
  entityType: IP
incidentConfiguration:
  createIncident: true
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
description: |
    'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
customDetails:
  critical_ip: SourceIP
requiredDataConnectors:
- connectorId: CiscoSDWAN
  dataTypes:
  - CiscoSyslogUTD
- connectorId: CiscoSDWAN
  dataTypes:
  - CiscoSDWANNetflow
triggerOperator: gt
version: 1.0.1
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: a62a207e-62be-4a74-acab-4466d5b3854f
queryFrequency: 3h
query: |
  CiscoSyslogUTD
  | union (CiscoSDWANNetflow)
  | where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
  | extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
  | where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
  | summarize count() by SourceIP  
severity: High
status: Available
queryPeriod: 3h
name: Cisco SDWAN - Monitor Critical IPs
tactics:
- CommandAndControl
kind: Scheduled

ARM