Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

ApexOne - Multiple deny or terminate actions on single IP

Back
Idcd94e078-67b7-11ec-90d6-0242ac120003
RulenameApexOne - Multiple deny or terminate actions on single IP
DescriptionDetects multiple deny or terminate actions on single IP.
SeverityHigh
TacticsInitialAccess
TechniquesT1190
Required data connectorsCefAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
Version1.0.3
Arm templatecd94e078-67b7-11ec-90d6-0242ac120003.json
Deploy To Azure
let threshold = 5;
TMApexOneEvent
| where EventMessage has "Behavior Monitoring"
| where DvcAction == 2 or DvcAction == 3
| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
| where count_ > threshold
| extend IPCustomEntity = SrcIpAddr
status: Available
id: cd94e078-67b7-11ec-90d6-0242ac120003
query: |
  let threshold = 5;
  TMApexOneEvent
  | where EventMessage has "Behavior Monitoring"
  | where DvcAction == 2 or DvcAction == 3
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
  | where count_ > threshold
  | extend IPCustomEntity = SrcIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
description: |
    'Detects multiple deny or terminate actions on single IP.'
name: ApexOne - Multiple deny or terminate actions on single IP
relevantTechniques:
- T1190
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
triggerThreshold: 0
severity: High
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
queryFrequency: 1h
queryPeriod: 1h
version: 1.0.3
kind: Scheduled
tactics:
- InitialAccess
triggerOperator: gt
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cd94e078-67b7-11ec-90d6-0242ac120003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cd94e078-67b7-11ec-90d6-0242ac120003')]",
      "properties": {
        "alertRuleTemplateName": "cd94e078-67b7-11ec-90d6-0242ac120003",
        "customDetails": null,
        "description": "'Detects multiple deny or terminate actions on single IP.'\n",
        "displayName": "ApexOne - Multiple deny or terminate actions on single IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml",
        "query": "let threshold = 5;\nTMApexOneEvent\n| where EventMessage has \"Behavior Monitoring\"\n| where DvcAction == 2 or DvcAction == 3\n| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}