TI map Domain entity to PaloAlto CommonSecurityLog

Back


Id	dd0a6029-ecef-4507-89c4-fc355ac52111
Rulename	TI map Domain entity to PaloAlto CommonSecurityLog
Description	Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI
Severity	Medium
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	MicrosoftDefenderThreatIntelligence ThreatIntelligence ThreatIntelligenceTaxii
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml
Version	1.4.2
Arm template	dd0a6029-ecef-4507-89c4-fc355ac52111.json

KQL

let dt_lookBack = 1h; // Look back 1 hour
let ioc_lookBack = 14d; // Look back 14 days
// Create a list of top-level domains (TLDs) from the threat feed data for later validation
let SecurityLog = materialize(
  CommonSecurityLog
    // Filter common security logs based on the specified time range
    | extend IngestionTime = ingestion_time()
    | where IngestionTime > ago(dt_lookBack)
    | where DeviceEventClassID =~ 'url'
    // Uncomment the line below to only alert on allowed connections
    //| where DeviceAction !~ "block-url"
    // Extract the domain from RequestURL, if not present, extract it from AdditionalExtensions
    | extend PA_Url = column_ifexists("RequestURL", "None")
    | extend PA_Url = iif(isempty(PA_Url) and AdditionalExtensions !startswith "PanOS", extract("([^\\\"]+)", 1, tolower(AdditionalExtensions)), trim('"', PA_Url))
    | extend PA_Url = iif(PA_Url !startswith "http://" and ApplicationProtocol !~ "ssl", strcat('http://', PA_Url), iif(PA_Url !startswith "https://" and ApplicationProtocol =~ "ssl", strcat('https://', PA_Url), PA_Url))
    | extend Domain = trim('"', tostring(parse_url(PA_Url).Host))
    | where isnotempty(Domain)
    | extend Domain = tolower(Domain)
    | extend CommonSecurityLog_TimeGenerated = TimeGenerated
);
let LogDomains = SecurityLog | distinct Domain | summarize make_list(Domain);
// Retrieve threat intelligence indicators within the specified time range
let Domain_Indicators = materialize(
    ThreatIntelligenceIndicator
    | where isnotempty(DomainName)
    | where TimeGenerated >= ago(ioc_lookBack)
    | extend TI_DomainEntity = tolower(DomainName)
    | where TI_DomainEntity in (LogDomains)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
    | where Active == true and ExpirationDateTime > now());
// Join threat intelligence indicators with common security logs
Domain_Indicators | join kind=innerunique (SecurityLog) on $left.TI_DomainEntity == $right.Domain
| where CommonSecurityLog_TimeGenerated < ExpirationDateTime
| summarize CommonSecurityLog_TimeGenerated = arg_max(CommonSecurityLog_TimeGenerated, *) by IndicatorId
| project CommonSecurityLog_TimeGenerated, Description, ActivityGroupNames, PA_Url, Domain, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DeviceAction, DestinationIP, DestinationPort, DeviceName, SourceIP, SourcePort, ApplicationProtocol, RequestMethod, Type, TI_DomainEntity
| extend timestamp = CommonSecurityLog_TimeGenerated

YAML

queryPeriod: 14d
queryFrequency: 1h
name: TI map Domain entity to PaloAlto CommonSecurityLog
id: dd0a6029-ecef-4507-89c4-fc355ac52111
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DeviceName
    identifier: HostName
- entityType: IP
  fieldMappings:
  - columnName: SourceIP
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: PA_Url
    identifier: Url
query: |
  let dt_lookBack = 1h; // Look back 1 hour
  let ioc_lookBack = 14d; // Look back 14 days
  // Create a list of top-level domains (TLDs) from the threat feed data for later validation
  let SecurityLog = materialize(
    CommonSecurityLog
      // Filter common security logs based on the specified time range
      | extend IngestionTime = ingestion_time()
      | where IngestionTime > ago(dt_lookBack)
      | where DeviceEventClassID =~ 'url'
      // Uncomment the line below to only alert on allowed connections
      //| where DeviceAction !~ "block-url"
      // Extract the domain from RequestURL, if not present, extract it from AdditionalExtensions
      | extend PA_Url = column_ifexists("RequestURL", "None")
      | extend PA_Url = iif(isempty(PA_Url) and AdditionalExtensions !startswith "PanOS", extract("([^\\\"]+)", 1, tolower(AdditionalExtensions)), trim('"', PA_Url))
      | extend PA_Url = iif(PA_Url !startswith "http://" and ApplicationProtocol !~ "ssl", strcat('http://', PA_Url), iif(PA_Url !startswith "https://" and ApplicationProtocol =~ "ssl", strcat('https://', PA_Url), PA_Url))
      | extend Domain = trim('"', tostring(parse_url(PA_Url).Host))
      | where isnotempty(Domain)
      | extend Domain = tolower(Domain)
      | extend CommonSecurityLog_TimeGenerated = TimeGenerated
  );
  let LogDomains = SecurityLog | distinct Domain | summarize make_list(Domain);
  // Retrieve threat intelligence indicators within the specified time range
  let Domain_Indicators = materialize(
      ThreatIntelligenceIndicator
      | where isnotempty(DomainName)
      | where TimeGenerated >= ago(ioc_lookBack)
      | extend TI_DomainEntity = tolower(DomainName)
      | where TI_DomainEntity in (LogDomains)
      | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
      | where Active == true and ExpirationDateTime > now());
  // Join threat intelligence indicators with common security logs
  Domain_Indicators | join kind=innerunique (SecurityLog) on $left.TI_DomainEntity == $right.Domain
  | where CommonSecurityLog_TimeGenerated < ExpirationDateTime
  | summarize CommonSecurityLog_TimeGenerated = arg_max(CommonSecurityLog_TimeGenerated, *) by IndicatorId
  | project CommonSecurityLog_TimeGenerated, Description, ActivityGroupNames, PA_Url, Domain, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DeviceAction, DestinationIP, DestinationPort, DeviceName, SourceIP, SourcePort, ApplicationProtocol, RequestMethod, Type, TI_DomainEntity
  | extend timestamp = CommonSecurityLog_TimeGenerated  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml
requiredDataConnectors:
- connectorId: ThreatIntelligence
  dataTypes:
  - ThreatIntelligenceIndicator
- connectorId: ThreatIntelligenceTaxii
  dataTypes:
  - ThreatIntelligenceIndicator
- connectorId: MicrosoftDefenderThreatIntelligence
  dataTypes:
  - ThreatIntelligenceIndicator
relevantTechniques:
- T1071
description: |
    Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI
tactics:
- CommandAndControl
severity: Medium
triggerThreshold: 0
version: 1.4.2
kind: Scheduled
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dd0a6029-ecef-4507-89c4-fc355ac52111')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dd0a6029-ecef-4507-89c4-fc355ac52111')]",
      "properties": {
        "alertRuleTemplateName": "dd0a6029-ecef-4507-89c4-fc355ac52111",
        "customDetails": null,
        "description": "Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI\n",
        "displayName": "TI map Domain entity to PaloAlto CommonSecurityLog",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceName",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "PA_Url",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_CommonSecurityLog.yaml",
        "query": "let dt_lookBack = 1h; // Look back 1 hour\nlet ioc_lookBack = 14d; // Look back 14 days\n// Create a list of top-level domains (TLDs) from the threat feed data for later validation\nlet SecurityLog = materialize(\n  CommonSecurityLog\n    // Filter common security logs based on the specified time range\n    | extend IngestionTime = ingestion_time()\n    | where IngestionTime > ago(dt_lookBack)\n    | where DeviceEventClassID =~ 'url'\n    // Uncomment the line below to only alert on allowed connections\n    //| where DeviceAction !~ \"block-url\"\n    // Extract the domain from RequestURL, if not present, extract it from AdditionalExtensions\n    | extend PA_Url = column_ifexists(\"RequestURL\", \"None\")\n    | extend PA_Url = iif(isempty(PA_Url) and AdditionalExtensions !startswith \"PanOS\", extract(\"([^\\\\\\\"]+)\", 1, tolower(AdditionalExtensions)), trim('\"', PA_Url))\n    | extend PA_Url = iif(PA_Url !startswith \"http://\" and ApplicationProtocol !~ \"ssl\", strcat('http://', PA_Url), iif(PA_Url !startswith \"https://\" and ApplicationProtocol =~ \"ssl\", strcat('https://', PA_Url), PA_Url))\n    | extend Domain = trim('\"', tostring(parse_url(PA_Url).Host))\n    | where isnotempty(Domain)\n    | extend Domain = tolower(Domain)\n    | extend CommonSecurityLog_TimeGenerated = TimeGenerated\n);\nlet LogDomains = SecurityLog | distinct Domain | summarize make_list(Domain);\n// Retrieve threat intelligence indicators within the specified time range\nlet Domain_Indicators = materialize(\n    ThreatIntelligenceIndicator\n    | where isnotempty(DomainName)\n    | where TimeGenerated >= ago(ioc_lookBack)\n    | extend TI_DomainEntity = tolower(DomainName)\n    | where TI_DomainEntity in (LogDomains)\n    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n    | where Active == true and ExpirationDateTime > now());\n// Join threat intelligence indicators with common security logs\nDomain_Indicators | join kind=innerunique (SecurityLog) on $left.TI_DomainEntity == $right.Domain\n| where CommonSecurityLog_TimeGenerated < ExpirationDateTime\n| summarize CommonSecurityLog_TimeGenerated = arg_max(CommonSecurityLog_TimeGenerated, *) by IndicatorId\n| project CommonSecurityLog_TimeGenerated, Description, ActivityGroupNames, PA_Url, Domain, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DeviceAction, DestinationIP, DestinationPort, DeviceName, SourceIP, SourcePort, ApplicationProtocol, RequestMethod, Type, TI_DomainEntity\n| extend timestamp = CommonSecurityLog_TimeGenerated\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl"
        ],
        "techniques": [
          "T1071"
        ],
        "templateVersion": "1.4.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}