CiscoSyslogUTD
| where isnotempty(Malware) and Malware != "None"
| distinct Malware, SourceIP
| join kind=inner (CiscoSDWANNetflow
| where isnotempty(NetflowUsername)
| summarize arg_max(TimeStamp, NetflowUsername) by NetflowFwSrcAddrIpv4
| distinct
["Username"] = NetflowUsername,
["SourceIP"] = NetflowFwSrcAddrIpv4) on SourceIP
| project Malware, SourceIP, Username
relevantTechniques:
- T1587.001
entityMappings:
- fieldMappings:
- columnName: SourceIP
identifier: Address
entityType: IP
- fieldMappings:
- columnName: Malware
identifier: Name
entityType: Malware
- fieldMappings:
- columnName: Username
identifier: Name
entityType: Account
incidentConfiguration:
createIncident: true
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelMalwareEvents.yaml
description: |
'This analytic rule will monitor Malware Events in Syslog and Netflow Data'
customDetails:
mal_malware: Malware
mal_src_ip: SourceIP
mal_username: Username
requiredDataConnectors:
- connectorId: CiscoSDWAN
dataTypes:
- CiscoSyslogUTD
- connectorId: CiscoSDWAN
dataTypes:
- CiscoSDWANNetflow
triggerOperator: gt
version: 1.0.1
eventGroupingSettings:
aggregationKind: AlertPerResult
id: cb14defd-3415-4420-a2e4-2dd0f3e07a86
queryFrequency: 3h
query: |
CiscoSyslogUTD
| where isnotempty(Malware) and Malware != "None"
| distinct Malware, SourceIP
| join kind=inner (CiscoSDWANNetflow
| where isnotempty(NetflowUsername)
| summarize arg_max(TimeStamp, NetflowUsername) by NetflowFwSrcAddrIpv4
| distinct
["Username"] = NetflowUsername,
["SourceIP"] = NetflowFwSrcAddrIpv4) on SourceIP
| project Malware, SourceIP, Username
severity: High
status: Available
queryPeriod: 3h
name: Cisco SDWAN - Maleware Events
tactics:
- ResourceDevelopment
kind: Scheduled
