Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

ApexOne - Multiple deny or terminate actions on single IP

Back
Idcd94e078-67b7-11ec-90d6-0242ac120003
RulenameApexOne - Multiple deny or terminate actions on single IP
DescriptionDetects multiple deny or terminate actions on single IP.
SeverityHigh
TacticsInitialAccess
TechniquesT1190
Required data connectorsCefAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
Version1.0.3
Arm templatecd94e078-67b7-11ec-90d6-0242ac120003.json
Deploy To Azure
let threshold = 5;
TMApexOneEvent
| where EventMessage has "Behavior Monitoring"
| where DvcAction == 2 or DvcAction == 3
| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
| where count_ > threshold
| extend IPCustomEntity = SrcIpAddr
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
triggerThreshold: 0
relevantTechniques:
- T1190
queryPeriod: 1h
version: 1.0.3
id: cd94e078-67b7-11ec-90d6-0242ac120003
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
query: |
  let threshold = 5;
  TMApexOneEvent
  | where EventMessage has "Behavior Monitoring"
  | where DvcAction == 2 or DvcAction == 3
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
  | where count_ > threshold
  | extend IPCustomEntity = SrcIpAddr  
status: Available
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
tactics:
- InitialAccess
severity: High
name: ApexOne - Multiple deny or terminate actions on single IP
queryFrequency: 1h
triggerOperator: gt
kind: Scheduled
description: |
    'Detects multiple deny or terminate actions on single IP.'
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cd94e078-67b7-11ec-90d6-0242ac120003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cd94e078-67b7-11ec-90d6-0242ac120003')]",
      "properties": {
        "alertRuleTemplateName": "cd94e078-67b7-11ec-90d6-0242ac120003",
        "customDetails": null,
        "description": "'Detects multiple deny or terminate actions on single IP.'\n",
        "displayName": "ApexOne - Multiple deny or terminate actions on single IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml",
        "query": "let threshold = 5;\nTMApexOneEvent\n| where EventMessage has \"Behavior Monitoring\"\n| where DvcAction == 2 or DvcAction == 3\n| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}