Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

ApexOne - Multiple deny or terminate actions on single IP

Back
Idcd94e078-67b7-11ec-90d6-0242ac120003
RulenameApexOne - Multiple deny or terminate actions on single IP
DescriptionDetects multiple deny or terminate actions on single IP.
SeverityHigh
TacticsInitialAccess
TechniquesT1190
Required data connectorsTrendMicroApexOne
TrendMicroApexOneAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
Version1.0.1
Arm templatecd94e078-67b7-11ec-90d6-0242ac120003.json
Deploy To Azure
let threshold = 5;
TMApexOneEvent
| where EventMessage has "Behavior Monitoring"
| where DvcAction == 2 or DvcAction == 3
| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
| where count_ > threshold
| extend IPCustomEntity = SrcIpAddr
severity: High
relevantTechniques:
- T1190
queryFrequency: 1h
kind: Scheduled
version: 1.0.1
name: ApexOne - Multiple deny or terminate actions on single IP
triggerOperator: gt
description: |
    'Detects multiple deny or terminate actions on single IP.'
queryPeriod: 1h
query: |
  let threshold = 5;
  TMApexOneEvent
  | where EventMessage has "Behavior Monitoring"
  | where DvcAction == 2 or DvcAction == 3
  | summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)
  | where count_ > threshold
  | extend IPCustomEntity = SrcIpAddr  
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
tactics:
- InitialAccess
status: Available
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml
id: cd94e078-67b7-11ec-90d6-0242ac120003
requiredDataConnectors:
- dataTypes:
  - TMApexOneEvent
  connectorId: TrendMicroApexOne
- dataTypes:
  - TMApexOneEvent
  connectorId: TrendMicroApexOneAma
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cd94e078-67b7-11ec-90d6-0242ac120003')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cd94e078-67b7-11ec-90d6-0242ac120003')]",
      "properties": {
        "alertRuleTemplateName": "cd94e078-67b7-11ec-90d6-0242ac120003",
        "customDetails": null,
        "description": "'Detects multiple deny or terminate actions on single IP.'\n",
        "displayName": "ApexOne - Multiple deny or terminate actions on single IP",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Apex One/Analytic Rules/TMApexOneMultipleDenyOrTerminateActionOnSingleIp.yaml",
        "query": "let threshold = 5;\nTMApexOneEvent\n| where EventMessage has \"Behavior Monitoring\"\n| where DvcAction == 2 or DvcAction == 3\n| summarize count() by SrcIpAddr, bin(TimeGenerated, 10m)\n| where count_ > threshold\n| extend IPCustomEntity = SrcIpAddr\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}