Radiflow - Network Scanning Detected

Back


Id	cde00cc5-5841-4aa9-96c5-dd836f9e3f26
Rulename	Radiflow - Network Scanning Detected
Description	Generates an incident when a network scan is detected either by Radiflow’s iSID.
Severity	High
Tactics	Discovery
Techniques	T0840 T0846 T0888
Required data connectors	RadiflowIsid
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Radiflow/Analytic Rules/RadiflowNetworkScanningDetected.yaml
Version	1.0.0
Arm template	cde00cc5-5841-4aa9-96c5-dd836f9e3f26.json

KQL

RadiflowEvent
| where DeviceProduct =~ 'iSID'
| where
    (
        EventClassID in (52, 105, 150, 151, 152, 153, 158, 166, 175)
        or EventMessage has 'Scan'
    )

YAML

id: cde00cc5-5841-4aa9-96c5-dd836f9e3f26
suppressionDuration: 5h
triggerOperator: gt
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: SourceHostName
  - identifier: NetBiosName
    columnName: SourceHostName
  entityType: Host
- fieldMappings:
  - identifier: HostName
    columnName: DestinationHostName
  - identifier: NetBiosName
    columnName: DestinationHostName
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
- fieldMappings:
  - identifier: Address
    columnName: DestinationIP
  entityType: IP
eventGroupingSettings:
  aggregationKind: AlertPerResult
requiredDataConnectors:
- dataTypes:
  - RadiflowEvent
  connectorId: RadiflowIsid
queryFrequency: 1h
alertDetailsOverride:
  alertDynamicProperties: []
  alertDisplayNameFormat: 'Network Scanning Detected: {{EventMessage}}'
  alertSeverityColumnName: EventSeverity
  alertDescriptionFormat: "A suspicious network scan activity has been detected in the network. Please check the the alert details for further information.\n\nMessage: {{EventMessage}}\nSource device: {{SourceIP}}\nDestination device (if any): {{DestinationIP}} "
suppressionEnabled: false
queryPeriod: 1h
status: Available
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1h
    groupByAlertDetails: []
    reopenClosedIncident: false
    matchingMethod: AllEntities
    groupByCustomDetails: []
    groupByEntities: []
    enabled: true
  createIncident: true
query: |
  RadiflowEvent
  | where DeviceProduct =~ 'iSID'
  | where
      (
          EventClassID in (52, 105, 150, 151, 152, 153, 158, 166, 175)
          or EventMessage has 'Scan'
      )  
name: Radiflow - Network Scanning Detected
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Radiflow/Analytic Rules/RadiflowNetworkScanningDetected.yaml
tactics:
- Discovery
severity: High
relevantTechniques:
- T0840
- T0846
- T0888
triggerThreshold: 0
version: 1.0.0
description: |
    'Generates an incident when a network scan is detected either by Radiflow's iSID.'
customDetails:
  Port: Port
  SourceMAC: SourceMACAddress
  SourceIP: SourceIP
  SourceHostName: SourceHostName
  SourceVendor: SourceVendor
  DestinationIP: DestinationIP
  DestinationVendor: DestinationVendor
  Protocol: Protocol
  SourceVLAN: SourceVLAN
  DestinationType: DestinationType
  DestinationHostName: DestinationHostName
  DestinationMAC: DestinationMACAddress
  SourceType: SourceType

ARM