Datawiza - massive errors detected

Back


Id	ddee1398-cf0b-46af-b583-78c3c29156dc
Rulename	Datawiza - massive errors detected
Description	“This rule is designed to identify when the system is experiencing abnormal errors.”
Severity	Medium
Tactics	Discovery
Techniques	T1082
Required data connectors	DatawizaDapSolution
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Datawiza/Analytic Rules/DatawizaSentinelAlerts.yaml
Version	1.0.0
Arm template	ddee1398-cf0b-46af-b583-78c3c29156dc.json

KQL

let timeFrame = 10m;
datawizaserveraccess_CL
| where TimeGenerated between (ago(timeFrame) .. now())
  and Status_d >= 500
| summarize Count = count()
| where Count > 100

YAML

id: ddee1398-cf0b-46af-b583-78c3c29156dc
triggerOperator: GreaterThan
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Datawiza/Analytic Rules/DatawizaSentinelAlerts.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
requiredDataConnectors:
- dataTypes:
  - datawizaserveraccess_CL
  connectorId: DatawizaDapSolution
queryFrequency: 10m
alertDetailsOverride:
  alertDisplayNameFormat: Datawiza Massive Error Detection
  alertDescriptionFormat: |
        Detected {{Count}} errors within 10 minutes. Please investigate unauthorized access attempts or misconfigurations.
queryPeriod: 10m
triggerThreshold: 0
query: |
  let timeFrame = 10m;
  datawizaserveraccess_CL
  | where TimeGenerated between (ago(timeFrame) .. now())
    and Status_d >= 500
  | summarize Count = count()
  | where Count > 100  
name: Datawiza - massive errors detected
kind: Scheduled
tactics:
- Discovery
severity: Medium
relevantTechniques:
- T1082
version: 1.0.0
description: |
    "This rule is designed to identify when the system is experiencing abnormal errors."

ARM