Forescout-DNS_Sniff_Event_Monitor

Back


Id	d272e277-f285-4dbc-ae2d-7f65ba64a79e
Rulename	Forescout-DNS_Sniff_Event_Monitor
Description	This rule creates an incident when more than certain number of Dnsniff events are generated from a host
Severity	Medium
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ForescoutHostPropertyMonitor/Analytic Rules/ForeScout-DNSSniffEventMonitor.yaml
Version	2.0.0
Arm template	d272e277-f285-4dbc-ae2d-7f65ba64a79e.json

KQL

ForescoutHostProperties_CL | extend  d = parse_json(HostProperties) | where d.DnsniffEvent matches regex "DNS Query Type:.A;DNS Query/Response:.Query" | extend ipaddress = iif(isnotempty(Ipv4Addr), Ipv4Addr, (iif(isnotempty(Ipv6Addr), Ipv6Addr, ""))) | where isnotempty(ipaddress) and isnotempty(EmIpAddr) | summarize NumEvents_d =count() by ipaddress, EmIpAddr | where NumEvents_d > 2 | sort by NumEvents_d asc | project NumEvents_d, ipaddress, EmIpAddr

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ForescoutHostPropertyMonitor/Analytic Rules/ForeScout-DNSSniffEventMonitor.yaml
kind: Scheduled
alertDetailsOverride:
  alertDescriptionFormat: Dnsniff-Address-Check alert
  alertDisplayNameFormat: Dnsniff-Address-Check
queryFrequency: 5m
query: ForescoutHostProperties_CL | extend  d = parse_json(HostProperties) | where d.DnsniffEvent matches regex "DNS Query Type:.A;DNS Query/Response:.Query" | extend ipaddress = iif(isnotempty(Ipv4Addr), Ipv4Addr, (iif(isnotempty(Ipv6Addr), Ipv6Addr, ""))) | where isnotempty(ipaddress) and isnotempty(EmIpAddr) | summarize NumEvents_d =count() by ipaddress, EmIpAddr | where NumEvents_d > 2 | sort by NumEvents_d asc | project NumEvents_d, ipaddress, EmIpAddr
relevantTechniques: []
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: ipaddress
    identifier: Address
requiredDataConnectors: []
customDetails:
  NumEvents: NumEvents_d
  EmIp: EmIpAddr
  Ip: ipaddress
name: Forescout-DNS_Sniff_Event_Monitor
triggerThreshold: 0
description: This rule creates an incident when more than certain number of Dnsniff events are generated from a host
queryPeriod: 5m
version: 2.0.0
triggerOperator: gt
tactics: []
severity: Medium
id: d272e277-f285-4dbc-ae2d-7f65ba64a79e

ARM