TI map Domain entity to PaloAlto CommonSecurityLog

Back


Id	dd0a6029-ecef-4507-89c4-fc355ac52111
Rulename	TI map Domain entity to PaloAlto CommonSecurityLog
Description	Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI
Severity	Medium
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	MicrosoftDefenderThreatIntelligence ThreatIntelligence ThreatIntelligenceTaxii
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml
Version	1.4.2
Arm template	dd0a6029-ecef-4507-89c4-fc355ac52111.json

KQL

let dt_lookBack = 1h; // Look back 1 hour
let ioc_lookBack = 14d; // Look back 14 days
// Create a list of top-level domains (TLDs) from the threat feed data for later validation
let SecurityLog = materialize(
  CommonSecurityLog
    // Filter common security logs based on the specified time range
    | extend IngestionTime = ingestion_time()
    | where IngestionTime > ago(dt_lookBack)
    | where DeviceEventClassID =~ 'url'
    // Uncomment the line below to only alert on allowed connections
    //| where DeviceAction !~ "block-url"
    // Extract the domain from RequestURL, if not present, extract it from AdditionalExtensions
    | extend PA_Url = column_ifexists("RequestURL", "None")
    | extend PA_Url = iif(isempty(PA_Url) and AdditionalExtensions !startswith "PanOS", extract("([^\\\"]+)", 1, tolower(AdditionalExtensions)), trim('"', PA_Url))
    | extend PA_Url = iif(PA_Url !startswith "http://" and ApplicationProtocol !~ "ssl", strcat('http://', PA_Url), iif(PA_Url !startswith "https://" and ApplicationProtocol =~ "ssl", strcat('https://', PA_Url), PA_Url))
    | extend Domain = trim('"', tostring(parse_url(PA_Url).Host))
    | where isnotempty(Domain)
    | extend Domain = tolower(Domain)
    | extend CommonSecurityLog_TimeGenerated = TimeGenerated
);
let LogDomains = SecurityLog | distinct Domain | summarize make_list(Domain);
// Retrieve threat intelligence indicators within the specified time range
let Domain_Indicators = materialize(
    ThreatIntelligenceIndicator
    | where isnotempty(DomainName)
    | where TimeGenerated >= ago(ioc_lookBack)
    | extend TI_DomainEntity = tolower(DomainName)
    | where TI_DomainEntity in (LogDomains)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
    | where Active == true and ExpirationDateTime > now());
// Join threat intelligence indicators with common security logs
Domain_Indicators | join kind=innerunique (SecurityLog) on $left.TI_DomainEntity == $right.Domain
| where CommonSecurityLog_TimeGenerated < ExpirationDateTime
| summarize CommonSecurityLog_TimeGenerated = arg_max(CommonSecurityLog_TimeGenerated, *) by IndicatorId
| project CommonSecurityLog_TimeGenerated, Description, ActivityGroupNames, PA_Url, Domain, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DeviceAction, DestinationIP, DestinationPort, DeviceName, SourceIP, SourcePort, ApplicationProtocol, RequestMethod, Type, TI_DomainEntity
| extend timestamp = CommonSecurityLog_TimeGenerated

YAML

relevantTechniques:
- T1071
name: TI map Domain entity to PaloAlto CommonSecurityLog
requiredDataConnectors:
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: ThreatIntelligence
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: ThreatIntelligenceTaxii
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: MicrosoftDefenderThreatIntelligence
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: DeviceName
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
- fieldMappings:
  - identifier: Url
    columnName: PA_Url
  entityType: URL
triggerThreshold: 0
id: dd0a6029-ecef-4507-89c4-fc355ac52111
tactics:
- CommandAndControl
version: 1.4.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml
queryPeriod: 14d
kind: Scheduled
queryFrequency: 1h
severity: Medium
description: |
    Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI
query: |
  let dt_lookBack = 1h; // Look back 1 hour
  let ioc_lookBack = 14d; // Look back 14 days
  // Create a list of top-level domains (TLDs) from the threat feed data for later validation
  let SecurityLog = materialize(
    CommonSecurityLog
      // Filter common security logs based on the specified time range
      | extend IngestionTime = ingestion_time()
      | where IngestionTime > ago(dt_lookBack)
      | where DeviceEventClassID =~ 'url'
      // Uncomment the line below to only alert on allowed connections
      //| where DeviceAction !~ "block-url"
      // Extract the domain from RequestURL, if not present, extract it from AdditionalExtensions
      | extend PA_Url = column_ifexists("RequestURL", "None")
      | extend PA_Url = iif(isempty(PA_Url) and AdditionalExtensions !startswith "PanOS", extract("([^\\\"]+)", 1, tolower(AdditionalExtensions)), trim('"', PA_Url))
      | extend PA_Url = iif(PA_Url !startswith "http://" and ApplicationProtocol !~ "ssl", strcat('http://', PA_Url), iif(PA_Url !startswith "https://" and ApplicationProtocol =~ "ssl", strcat('https://', PA_Url), PA_Url))
      | extend Domain = trim('"', tostring(parse_url(PA_Url).Host))
      | where isnotempty(Domain)
      | extend Domain = tolower(Domain)
      | extend CommonSecurityLog_TimeGenerated = TimeGenerated
  );
  let LogDomains = SecurityLog | distinct Domain | summarize make_list(Domain);
  // Retrieve threat intelligence indicators within the specified time range
  let Domain_Indicators = materialize(
      ThreatIntelligenceIndicator
      | where isnotempty(DomainName)
      | where TimeGenerated >= ago(ioc_lookBack)
      | extend TI_DomainEntity = tolower(DomainName)
      | where TI_DomainEntity in (LogDomains)
      | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
      | where Active == true and ExpirationDateTime > now());
  // Join threat intelligence indicators with common security logs
  Domain_Indicators | join kind=innerunique (SecurityLog) on $left.TI_DomainEntity == $right.Domain
  | where CommonSecurityLog_TimeGenerated < ExpirationDateTime
  | summarize CommonSecurityLog_TimeGenerated = arg_max(CommonSecurityLog_TimeGenerated, *) by IndicatorId
  | project CommonSecurityLog_TimeGenerated, Description, ActivityGroupNames, PA_Url, Domain, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DeviceAction, DestinationIP, DestinationPort, DeviceName, SourceIP, SourcePort, ApplicationProtocol, RequestMethod, Type, TI_DomainEntity
  | extend timestamp = CommonSecurityLog_TimeGenerated  
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dd0a6029-ecef-4507-89c4-fc355ac52111')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dd0a6029-ecef-4507-89c4-fc355ac52111')]",
      "properties": {
        "alertRuleTemplateName": "dd0a6029-ecef-4507-89c4-fc355ac52111",
        "customDetails": null,
        "description": "Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI\n",
        "displayName": "TI map Domain entity to PaloAlto CommonSecurityLog",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceName",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "PA_Url",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml",
        "query": "let dt_lookBack = 1h; // Look back 1 hour\nlet ioc_lookBack = 14d; // Look back 14 days\n// Create a list of top-level domains (TLDs) from the threat feed data for later validation\nlet SecurityLog = materialize(\n  CommonSecurityLog\n    // Filter common security logs based on the specified time range\n    | extend IngestionTime = ingestion_time()\n    | where IngestionTime > ago(dt_lookBack)\n    | where DeviceEventClassID =~ 'url'\n    // Uncomment the line below to only alert on allowed connections\n    //| where DeviceAction !~ \"block-url\"\n    // Extract the domain from RequestURL, if not present, extract it from AdditionalExtensions\n    | extend PA_Url = column_ifexists(\"RequestURL\", \"None\")\n    | extend PA_Url = iif(isempty(PA_Url) and AdditionalExtensions !startswith \"PanOS\", extract(\"([^\\\\\\\"]+)\", 1, tolower(AdditionalExtensions)), trim('\"', PA_Url))\n    | extend PA_Url = iif(PA_Url !startswith \"http://\" and ApplicationProtocol !~ \"ssl\", strcat('http://', PA_Url), iif(PA_Url !startswith \"https://\" and ApplicationProtocol =~ \"ssl\", strcat('https://', PA_Url), PA_Url))\n    | extend Domain = trim('\"', tostring(parse_url(PA_Url).Host))\n    | where isnotempty(Domain)\n    | extend Domain = tolower(Domain)\n    | extend CommonSecurityLog_TimeGenerated = TimeGenerated\n);\nlet LogDomains = SecurityLog | distinct Domain | summarize make_list(Domain);\n// Retrieve threat intelligence indicators within the specified time range\nlet Domain_Indicators = materialize(\n    ThreatIntelligenceIndicator\n    | where isnotempty(DomainName)\n    | where TimeGenerated >= ago(ioc_lookBack)\n    | extend TI_DomainEntity = tolower(DomainName)\n    | where TI_DomainEntity in (LogDomains)\n    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n    | where Active == true and ExpirationDateTime > now());\n// Join threat intelligence indicators with common security logs\nDomain_Indicators | join kind=innerunique (SecurityLog) on $left.TI_DomainEntity == $right.Domain\n| where CommonSecurityLog_TimeGenerated < ExpirationDateTime\n| summarize CommonSecurityLog_TimeGenerated = arg_max(CommonSecurityLog_TimeGenerated, *) by IndicatorId\n| project CommonSecurityLog_TimeGenerated, Description, ActivityGroupNames, PA_Url, Domain, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DeviceAction, DestinationIP, DestinationPort, DeviceName, SourceIP, SourcePort, ApplicationProtocol, RequestMethod, Type, TI_DomainEntity\n| extend timestamp = CommonSecurityLog_TimeGenerated\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl"
        ],
        "techniques": [
          "T1071"
        ],
        "templateVersion": "1.4.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}