Cisco SDWAN - IPS Event Threshold

Back


Id	dc3627c3-f9de-4f17-bfd3-ba99b64a0a67
Rulename	Cisco SDWAN - IPS Event Threshold
Description	This analytic rule will monitor specific IPS event in the data.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1189
Required data connectors	CiscoSDWAN
Kind	Scheduled
Query frequency	3h
Query period	3h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelIPSEventThreshold.yaml
Version	1.0.1
Arm template	dc3627c3-f9de-4f17-bfd3-ba99b64a0a67.json

KQL

CiscoSyslogUTD 
| where Classification == "Enter classification" 
| summarize count() by Classification 
| where count_ > 10

YAML

queryPeriod: 3h
query: |
  CiscoSyslogUTD 
  | where Classification == "Enter classification" 
  | summarize count() by Classification 
  | where count_ > 10  
name: Cisco SDWAN - IPS Event Threshold
entityMappings:
- fieldMappings:
  - columnName: Classification
    identifier: Name
  entityType: Malware
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 3h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco SD-WAN/Analytic Rules/CiscoSDWANSentinelIPSEventThreshold.yaml
requiredDataConnectors:
- connectorId: CiscoSDWAN
  dataTypes:
  - CiscoSyslogUTD
description: |
    'This analytic rule will monitor specific IPS event in the data.'
kind: Scheduled
incidentConfiguration:
  createIncident: true
version: 1.0.1
status: Available
severity: High
relevantTechniques:
- T1190
- T1189
triggerOperator: gt
triggerThreshold: 0
customDetails:
  classification_count: count_
  classification: Classification
tactics:
- InitialAccess
id: dc3627c3-f9de-4f17-bfd3-ba99b64a0a67

ARM