Cloudflare - WAF Allowed threat

Back


Id	f53fe2a9-96b5-454c-827e-cf1764a67fb1
Rulename	Cloudflare - WAF Allowed threat
Description	Detects WAF “Allowed” action on threat events.
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CloudflareDataConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare CCF/Analytic Rules/CloudflareCCFWafThreatAllowed.yaml
Version	1.0.1
Arm template	f53fe2a9-96b5-454c-827e-cf1764a67fb1.json

KQL

Cloudflare
| where isnotempty(WAFRuleID) or isnotempty(WAFRuleMessage)
| where WAFAction =~ 'Allow'
| extend CompleteUrl = strcat(HttpRequestHeaderHost,ClientRequestPath)

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cloudflare CCF/Analytic Rules/CloudflareCCFWafThreatAllowed.yaml
queryFrequency: 1h
name: Cloudflare - WAF Allowed threat
severity: High
triggerThreshold: 0
query: |
  Cloudflare
  | where isnotempty(WAFRuleID) or isnotempty(WAFRuleMessage)
  | where WAFAction =~ 'Allow'
  | extend CompleteUrl = strcat(HttpRequestHeaderHost,ClientRequestPath)  
requiredDataConnectors:
- dataTypes:
  - Cloudflare
  connectorId: CloudflareDataConnector
relevantTechniques:
- T1190
- T1133
status: Available
triggerOperator: gt
queryPeriod: 1h
description: |
    'Detects WAF "Allowed" action on threat events.'
id: f53fe2a9-96b5-454c-827e-cf1764a67fb1
version: 1.0.1
entityMappings:
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
- fieldMappings:
  - columnName: CompleteUrl
    identifier: Url
  entityType: URL
kind: Scheduled
tactics:
- InitialAccess

ARM