Cisco SDWAN - Monitor Critical IPs

Back


Id	a62a207e-62be-4a74-acab-4466d5b3854f
Rulename	Cisco SDWAN - Monitor Critical IPs
Description	This analytic rule will monitor critical IPs in Syslog and Netflow Data.
Severity	High
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	CiscoSDWAN
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
Version	1.0.1
Arm template	a62a207e-62be-4a74-acab-4466d5b3854f.json

KQL

CiscoSyslogUTD
| union (CiscoSDWANNetflow)
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
| summarize count() by SourceIP

YAML

entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
tactics:
- CommandAndControl
requiredDataConnectors:
- dataTypes:
  - CiscoSyslogUTD
  connectorId: CiscoSDWAN
- dataTypes:
  - CiscoSDWANNetflow
  connectorId: CiscoSDWAN
incidentConfiguration:
  createIncident: true
id: a62a207e-62be-4a74-acab-4466d5b3854f
severity: High
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available
customDetails:
  critical_ip: SourceIP
query: |
  CiscoSyslogUTD
  | union (CiscoSDWANNetflow)
  | where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
  | extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
  | where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
  | summarize count() by SourceIP  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
kind: Scheduled
queryPeriod: 3h
version: 1.0.1
name: Cisco SDWAN - Monitor Critical IPs
queryFrequency: 3h
triggerThreshold: 0
relevantTechniques:
- T1071
description: |
    'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
triggerOperator: gt

ARM