Cisco SDWAN - Monitor Critical IPs

Back


Id	a62a207e-62be-4a74-acab-4466d5b3854f
Rulename	Cisco SDWAN - Monitor Critical IPs
Description	This analytic rule will monitor critical IPs in Syslog and Netflow Data.
Severity	High
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	CiscoSDWAN
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
Version	1.0.1
Arm template	a62a207e-62be-4a74-acab-4466d5b3854f.json

KQL

CiscoSyslogUTD
| union (CiscoSDWANNetflow)
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
| summarize count() by SourceIP

YAML

eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
requiredDataConnectors:
- dataTypes:
  - CiscoSyslogUTD
  connectorId: CiscoSDWAN
- dataTypes:
  - CiscoSDWANNetflow
  connectorId: CiscoSDWAN
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
customDetails:
  critical_ip: SourceIP
incidentConfiguration:
  createIncident: true
name: Cisco SDWAN - Monitor Critical IPs
relevantTechniques:
- T1071
status: Available
version: 1.0.1
queryPeriod: 3h
kind: Scheduled
id: a62a207e-62be-4a74-acab-4466d5b3854f
query: |
  CiscoSyslogUTD
  | union (CiscoSDWANNetflow)
  | where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
  | extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
  | where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
  | summarize count() by SourceIP  
description: |
    'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
queryFrequency: 3h
severity: High
triggerOperator: gt
tactics:
- CommandAndControl

ARM