Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

ApexOne - Multiple deny or terminate actions on single IP

Back
Idcd94e078-67b7-11ec-90d6-0242ac120003
RulenameApexOne - Multiple deny or terminate actions on single IP
DescriptionDetects multiple deny or terminate actions on single IP.
SeverityHigh
TacticsInitialAccess
TechniquesT1190
Required data connectorsTrendMicroApexOne
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
Version1.0.0
Arm templatecd94e078-67b7-11ec-90d6-0242ac120003.json
Deploy To Azure
let threshold = 5;
TMApexOneEvent
| where EventMessage has "Behavior Monitoring"
| where DvcAction == 2 or DvcAction == 3
| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
| where count_ > threshold
| extend IPCustomEntity = SrcIpAddr
name: ApexOne - Multiple deny or terminate actions on single IP
query: |
  let threshold = 5;
  TMApexOneEvent
  | where EventMessage has "Behavior Monitoring"
  | where DvcAction == 2 or DvcAction == 3
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
  | where count_ > threshold
  | extend IPCustomEntity = SrcIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
queryFrequency: 1h
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - TMApexOneEvent
  connectorId: TrendMicroApexOne
version: 1.0.0
status: Available
queryPeriod: 1h
id: cd94e078-67b7-11ec-90d6-0242ac120003
triggerOperator: gt
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
relevantTechniques:
- T1190
severity: High
description: |
    'Detects multiple deny or terminate actions on single IP.'
kind: Scheduled
tactics:
- InitialAccess
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cd94e078-67b7-11ec-90d6-0242ac120003')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cd94e078-67b7-11ec-90d6-0242ac120003')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "ApexOne - Multiple deny or terminate actions on single IP",
        "description": "'Detects multiple deny or terminate actions on single IP.'\n",
        "severity": "High",
        "enabled": true,
        "query": "let threshold = 5;\nTMApexOneEvent\n| where EventMessage has \"Behavior Monitoring\"\n| where DvcAction == 2 or DvcAction == 3\n| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190"
        ],
        "alertRuleTemplateName": "cd94e078-67b7-11ec-90d6-0242ac120003",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "IPCustomEntity"
              }
            ],
            "entityType": "IP"
          }
        ],
        "status": "Available",
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml"
      }
    }
  ]
}