Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Awake Security - Model With Multiple Destinations

Back
Iddfa3ec92-bdae-410f-b675-fe1814e4d43e
RulenameAwake Security - Model With Multiple Destinations
DescriptionThis query searches for devices with multiple possibly malicious destinations.
SeverityMedium
Required data connectorsAristaAwakeSecurity
CefAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AristaAwakeSecurity/Analytic Rules/ModelMatchesWithMultipleDestinationsByDevice.yaml
Version1.0.1
Arm templatedfa3ec92-bdae-410f-b675-fe1814e4d43e.json
Deploy To Azure
CommonSecurityLog | where DeviceVendor == "Arista Networks" and DeviceProduct == "Awake Security"
| summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Models=make_set(Activity), ASPMatchURLs=make_set(DeviceCustomString2), SourceIPs=make_set(SourceIP),
  DestinationIPs=make_set(DestinationIP), ModelMatchCount=sum(EventCount), MaxSeverity=max(toint(LogSeverity)) by SourceHostName
| where array_length(DestinationIPs) > 1
status: Available
queryFrequency: 1h
description: This query searches for devices with multiple possibly malicious destinations.
customDetails:
  Matches_Max_Severity: MaxSeverity
  Matches_Count: ModelMatchCount
  Matches_Dest_IPs: DestinationIPs
  Matched_Models: Models
  Device: SourceHostName
  Matches_ASP_URLs: ASPMatchURLs
severity: Medium
version: 1.0.1
relevantTechniques: []
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: Selected
    lookbackDuration: 3d
    groupByAlertDetails: []
    groupByCustomDetails:
    - Device
    reopenClosedIncident: true
    groupByEntities:
    - Host
    enabled: true
  createIncident: true
name: Awake Security - Model With Multiple Destinations
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  CommonSecurityLog | where DeviceVendor == "Arista Networks" and DeviceProduct == "Awake Security"
  | summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Models=make_set(Activity), ASPMatchURLs=make_set(DeviceCustomString2), SourceIPs=make_set(SourceIP),
    DestinationIPs=make_set(DestinationIP), ModelMatchCount=sum(EventCount), MaxSeverity=max(toint(LogSeverity)) by SourceHostName
  | where array_length(DestinationIPs) > 1  
alertDetailsOverride:
  alertDisplayNameFormat: Awake Security - Model Matches With Multiple Destinations On Device {{SourceHostName}}
  alertDescriptionFormat: |
    Device {{SourceHostName}} communicated with multiple possibly malicious destinations.  The destination IPs were:

    {{DestinationIPs}}

    The associated with Awake model(s) were:

    {{Models}}    
  alertSeverityColumnName: 
  alertTacticsColumnName: 
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AristaAwakeSecurity/Analytic Rules/ModelMatchesWithMultipleDestinationsByDevice.yaml
requiredDataConnectors:
- connectorId: AristaAwakeSecurity
  dataTypes:
  - CommonSecurityLog (AwakeSecurity)
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
kind: Scheduled
tactics: []
id: dfa3ec92-bdae-410f-b675-fe1814e4d43e
queryPeriod: 1h
entityMappings:
- fieldMappings:
  - columnName: SourceHostName
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: SourceIPs
    identifier: Address
  entityType: IP
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dfa3ec92-bdae-410f-b675-fe1814e4d43e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dfa3ec92-bdae-410f-b675-fe1814e4d43e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Device {{SourceHostName}} communicated with multiple possibly malicious destinations.  The destination IPs were:\n\n{{DestinationIPs}}\n\nThe associated with Awake model(s) were:\n\n{{Models}}\n",
          "alertDisplayNameFormat": "Awake Security - Model Matches With Multiple Destinations On Device {{SourceHostName}}",
          "alertSeverityColumnName": null,
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "dfa3ec92-bdae-410f-b675-fe1814e4d43e",
        "customDetails": {
          "Device": "SourceHostName",
          "Matched_Models": "Models",
          "Matches_ASP_URLs": "ASPMatchURLs",
          "Matches_Count": "ModelMatchCount",
          "Matches_Dest_IPs": "DestinationIPs",
          "Matches_Max_Severity": "MaxSeverity"
        },
        "description": "This query searches for devices with multiple possibly malicious destinations.",
        "displayName": "Awake Security - Model With Multiple Destinations",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHostName",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIPs",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [
              "Device"
            ],
            "groupByEntities": [
              "Host"
            ],
            "lookbackDuration": "P3D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": true
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AristaAwakeSecurity/Analytic Rules/ModelMatchesWithMultipleDestinationsByDevice.yaml",
        "query": "CommonSecurityLog | where DeviceVendor == \"Arista Networks\" and DeviceProduct == \"Awake Security\"\n| summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Models=make_set(Activity), ASPMatchURLs=make_set(DeviceCustomString2), SourceIPs=make_set(SourceIP),\n  DestinationIPs=make_set(DestinationIP), ModelMatchCount=sum(EventCount), MaxSeverity=max(toint(LogSeverity)) by SourceHostName\n| where array_length(DestinationIPs) > 1\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}