Cloudflare - WAF Allowed threat

Back


Id	f53fe2a9-96b5-454c-827e-cf1764a67fb0
Rulename	Cloudflare - WAF Allowed threat
Description	Detects WAF “Allowed” action on threat events.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CloudflareDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareWafThreatAllowed.yaml
Version	1.0.0
Arm template	f53fe2a9-96b5-454c-827e-cf1764a67fb0.json

KQL

Cloudflare
| where isnotempty(WAFRuleID) or isnotempty(WAFRuleMessage)
| where WAFAction =~ 'Allow'
| extend IPCustomEntity = SrcIpAddr
| extend UrlCustomEntity = ClientRequestURI

YAML

description: |
    'Detects WAF "Allowed" action on threat events.'
kind: Scheduled
tactics:
- InitialAccess
requiredDataConnectors:
- connectorId: CloudflareDataConnector
  dataTypes:
  - Cloudflare
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare/Analytic Rules/CloudflareWafThreatAllowed.yaml
severity: High
name: Cloudflare - WAF Allowed threat
triggerThreshold: 0
queryPeriod: 1h
query: |
  Cloudflare
  | where isnotempty(WAFRuleID) or isnotempty(WAFRuleMessage)
  | where WAFAction =~ 'Allow'
  | extend IPCustomEntity = SrcIpAddr
  | extend UrlCustomEntity = ClientRequestURI  
relevantTechniques:
- T1190
- T1133
id: f53fe2a9-96b5-454c-827e-cf1764a67fb0
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.0
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url

ARM