Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Palo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports

Back
Iddf89f4bf-720e-41c5-a209-15e41e400d35
RulenamePalo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports
DescriptionDetects Network ACLs allow ingress traffic to server administration ports.
SeverityMedium
TacticsInitialAccess
TechniquesT1133
Required data connectorsPaloAltoPrismaCloud
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudAclAllowInToAdminPort.yaml
Version1.0.1
Arm templatedf89f4bf-720e-41c5-a209-15e41e400d35.json
Deploy To Azure
PaloAltoPrismaCloud
| where Reason =~ 'NEW_ALERT'
| where Status =~ 'open'
| where AlertMessage has 'Network ACLs allow ingress traffic to server administration ports'
| extend AccountCustomEntity = UserName
name: Palo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudAclAllowInToAdminPort.yaml
queryPeriod: 1h
version: 1.0.1
severity: Medium
id: df89f4bf-720e-41c5-a209-15e41e400d35
triggerOperator: gt
triggerThreshold: 0
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - PaloAltoPrismaCloud
  connectorId: PaloAltoPrismaCloud
relevantTechniques:
- T1133
description: |
    'Detects Network ACLs allow ingress traffic to server administration ports.'
query: |
  PaloAltoPrismaCloud
  | where Reason =~ 'NEW_ALERT'
  | where Status =~ 'open'
  | where AlertMessage has 'Network ACLs allow ingress traffic to server administration ports'
  | extend AccountCustomEntity = UserName  
tactics:
- InitialAccess
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
status: Available
queryFrequency: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/df89f4bf-720e-41c5-a209-15e41e400d35')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/df89f4bf-720e-41c5-a209-15e41e400d35')]",
      "properties": {
        "alertRuleTemplateName": "df89f4bf-720e-41c5-a209-15e41e400d35",
        "customDetails": null,
        "description": "'Detects Network ACLs allow ingress traffic to server administration ports.'\n",
        "displayName": "Palo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudAclAllowInToAdminPort.yaml",
        "query": "PaloAltoPrismaCloud\n| where Reason =~ 'NEW_ALERT'\n| where Status =~ 'open'\n| where AlertMessage has 'Network ACLs allow ingress traffic to server administration ports'\n| extend AccountCustomEntity = UserName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1133"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}