Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

PaloAlto - Dropping or denying session with traffic

Back
Idba663b74-51f4-11ec-bf63-0242ac130002
RulenamePaloAlto - Dropping or denying session with traffic
DescriptionDetects dropping or denying session with traffic.
SeverityMedium
TacticsInitialAccess
TechniquesT1190
T1133
Required data connectorsPaloAltoCDL
PaloAltoCDLAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLDroppingSessionWithSentTraffic.yaml
Version1.0.2
Arm templateba663b74-51f4-11ec-bf63-0242ac130002.json
Deploy To Azure
let threshold = 100;
PaloAltoCDLEvent
| where EventResourceId =~ 'TRAFFIC'
| where EventResult has_any ("deny", "drop", "reject") 
| where tolong(DstBytes) > 0
| where tolong(NetworkPackets) > 0
| summarize count() by SrcIpAddr, DstUsername, bin(TimeGenerated, 10m)
| where count_ > threshold
| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - PaloAltoCDLEvent
  connectorId: PaloAltoCDL
- dataTypes:
  - PaloAltoCDLEvent
  connectorId: PaloAltoCDLAma
queryPeriod: 1h
status: Available
kind: Scheduled
description: |
    'Detects dropping or denying session with traffic.'
query: |
  let threshold = 100;
  PaloAltoCDLEvent
  | where EventResourceId =~ 'TRAFFIC'
  | where EventResult has_any ("deny", "drop", "reject") 
  | where tolong(DstBytes) > 0
  | where tolong(NetworkPackets) > 0
  | summarize count() by SrcIpAddr, DstUsername, bin(TimeGenerated, 10m)
  | where count_ > threshold
  | extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr  
relevantTechniques:
- T1190
- T1133
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLDroppingSessionWithSentTraffic.yaml
severity: Medium
triggerThreshold: 0
name: PaloAlto - Dropping or denying session with traffic
tactics:
- InitialAccess
version: 1.0.2
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
id: ba663b74-51f4-11ec-bf63-0242ac130002
queryFrequency: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ba663b74-51f4-11ec-bf63-0242ac130002')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ba663b74-51f4-11ec-bf63-0242ac130002')]",
      "properties": {
        "alertRuleTemplateName": "ba663b74-51f4-11ec-bf63-0242ac130002",
        "customDetails": null,
        "description": "'Detects dropping or denying session with traffic.'\n",
        "displayName": "PaloAlto - Dropping or denying session with traffic",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLDroppingSessionWithSentTraffic.yaml",
        "query": "let threshold = 100;\nPaloAltoCDLEvent\n| where EventResourceId =~ 'TRAFFIC'\n| where EventResult has_any (\"deny\", \"drop\", \"reject\") \n| where tolong(DstBytes) > 0\n| where tolong(NetworkPackets) > 0\n| summarize count() by SrcIpAddr, DstUsername, bin(TimeGenerated, 10m)\n| where count_ > threshold\n| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}