Cisco SDWAN - Monitor Critical IPs

Back


Id	a62a207e-62be-4a74-acab-4466d5b3854f
Rulename	Cisco SDWAN - Monitor Critical IPs
Description	This analytic rule will monitor critical IPs in Syslog and Netflow Data.
Severity	High
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	CiscoSDWAN
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
Version	1.0.1
Arm template	a62a207e-62be-4a74-acab-4466d5b3854f.json

KQL

CiscoSyslogUTD
| union (CiscoSDWANNetflow)
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
| summarize count() by SourceIP

YAML

eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
queryPeriod: 3h
kind: Scheduled
name: Cisco SDWAN - Monitor Critical IPs
status: Available
customDetails:
  critical_ip: SourceIP
entityMappings:
- fieldMappings:
  - columnName: SourceIP
    identifier: Address
  entityType: IP
tactics:
- CommandAndControl
description: |
    'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMonitorCriticalIP.yaml
requiredDataConnectors:
- connectorId: CiscoSDWAN
  dataTypes:
  - CiscoSyslogUTD
- connectorId: CiscoSDWAN
  dataTypes:
  - CiscoSDWANNetflow
queryFrequency: 3h
triggerThreshold: 0
version: 1.0.1
query: |
  CiscoSyslogUTD
  | union (CiscoSDWANNetflow)
  | where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
  | extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
  | where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
  | summarize count() by SourceIP  
relevantTechniques:
- T1071
id: a62a207e-62be-4a74-acab-4466d5b3854f
triggerOperator: gt

ARM