Cloudflare - WAF Allowed threat

Back


Id	f53fe2a9-96b5-454c-827e-cf1764a67fb0
Rulename	Cloudflare - WAF Allowed threat
Description	Detects WAF “Allowed” action on threat events.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CloudflareDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareWafThreatAllowed.yaml
Version	1.0.1
Arm template	f53fe2a9-96b5-454c-827e-cf1764a67fb0.json

KQL

Cloudflare
| where isnotempty(WAFRuleID) or isnotempty(WAFRuleMessage)
| where WAFAction =~ 'Allow'
| extend CompleteUrl = strcat(HttpRequestHeaderHost,ClientRequestPath)

YAML

relevantTechniques:
- T1190
- T1133
entityMappings:
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: CompleteUrl
    identifier: Url
  entityType: URL
triggerThreshold: 0
description: |
    'Detects WAF "Allowed" action on threat events.'
requiredDataConnectors:
- connectorId: CloudflareDataConnector
  dataTypes:
  - Cloudflare
triggerOperator: gt
version: 1.0.1
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareWafThreatAllowed.yaml
id: f53fe2a9-96b5-454c-827e-cf1764a67fb0
queryFrequency: 1h
query: |
  Cloudflare
  | where isnotempty(WAFRuleID) or isnotempty(WAFRuleMessage)
  | where WAFAction =~ 'Allow'
  | extend CompleteUrl = strcat(HttpRequestHeaderHost,ClientRequestPath)  
severity: High
status: Available
queryPeriod: 1h
name: Cloudflare - WAF Allowed threat
tactics:
- InitialAccess
kind: Scheduled

ARM