Cloudflare - WAF Allowed threat

Back


Id	f53fe2a9-96b5-454c-827e-cf1764a67fb0
Rulename	Cloudflare - WAF Allowed threat
Description	Detects WAF “Allowed” action on threat events.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CloudflareDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareWafThreatAllowed.yaml
Version	1.0.1
Arm template	f53fe2a9-96b5-454c-827e-cf1764a67fb0.json

KQL

Cloudflare
| where isnotempty(WAFRuleID) or isnotempty(WAFRuleMessage)
| where WAFAction =~ 'Allow'
| extend CompleteUrl = strcat(HttpRequestHeaderHost,ClientRequestPath)

YAML

triggerThreshold: 0
version: 1.0.1
queryFrequency: 1h
severity: High
relevantTechniques:
- T1190
- T1133
requiredDataConnectors:
- dataTypes:
  - Cloudflare
  connectorId: CloudflareDataConnector
description: |
    'Detects WAF "Allowed" action on threat events.'
triggerOperator: gt
query: |
  Cloudflare
  | where isnotempty(WAFRuleID) or isnotempty(WAFRuleMessage)
  | where WAFAction =~ 'Allow'
  | extend CompleteUrl = strcat(HttpRequestHeaderHost,ClientRequestPath)  
tactics:
- InitialAccess
status: Available
queryPeriod: 1h
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
- fieldMappings:
  - identifier: Url
    columnName: CompleteUrl
  entityType: URL
id: f53fe2a9-96b5-454c-827e-cf1764a67fb0
name: Cloudflare - WAF Allowed threat
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareWafThreatAllowed.yaml

ARM