Cisco SDWAN - Monitor Critical IPs

Back


Id	a62a207e-62be-4a74-acab-4466d5b3854f
Rulename	Cisco SDWAN - Monitor Critical IPs
Description	This analytic rule will monitor critical IPs in Syslog and Netflow Data.
Severity	High
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	CiscoSDWAN
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
Version	1.0.1
Arm template	a62a207e-62be-4a74-acab-4466d5b3854f.json

KQL

CiscoSyslogUTD
| union (CiscoSDWANNetflow)
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
| summarize count() by SourceIP

YAML

triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
customDetails:
  critical_ip: SourceIP
relevantTechniques:
- T1071
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
status: Available
id: a62a207e-62be-4a74-acab-4466d5b3854f
query: |
  CiscoSyslogUTD
  | union (CiscoSDWANNetflow)
  | where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
  | extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
  | where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
  | summarize count() by SourceIP  
queryPeriod: 3h
name: Cisco SDWAN - Monitor Critical IPs
version: 1.0.1
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
kind: Scheduled
triggerOperator: gt
incidentConfiguration:
  createIncident: true
description: |
    'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
queryFrequency: 3h
requiredDataConnectors:
- dataTypes:
  - CiscoSyslogUTD
  connectorId: CiscoSDWAN
- dataTypes:
  - CiscoSDWANNetflow
  connectorId: CiscoSDWAN
tactics:
- CommandAndControl

ARM