Contrast Suspicious

Back


Id	f713404e-805c-4e0c-91fa-2c149f76a07d
Rulename	Contrast Suspicious
Description	Creates Incidents for Suspicious events sourced from the Contrast Protect agent.
Severity	Medium
Tactics	InitialAccess Exfiltration
Techniques	T1566
Required data connectors	CefAma ContrastProtect ContrastProtectAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastSuspicious.yaml
Version	1.0.2
Arm template	f713404e-805c-4e0c-91fa-2c149f76a07d.json

KQL

let extract_data=(a:string, k:string) {
  parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
};

CommonSecurityLog 
| where DeviceVendor == "Contrast Security"
| where AdditionalExtensions contains "SUSPICIOUS"
| extend DeviceProduct
| extend SourceIP
| extend DeviceVersion
| extend Activity
| extend ApplicationProtocol
| extend RequestURL
| extend RequestMethod
| extend Rule = extract_data(AdditionalExtensions, 'pri')

YAML

triggerThreshold: 0
queryFrequency: 5m
id: f713404e-805c-4e0c-91fa-2c149f76a07d
kind: Scheduled
description: |
    'Creates Incidents for Suspicious events sourced from the Contrast Protect agent.'
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: RequestURL
- entityType: CloudApplication
  fieldMappings:
  - identifier: Name
    columnName: ApplicationProtocol
- entityType: Malware
  fieldMappings:
  - identifier: Name
    columnName: Activity
  - identifier: Category
    columnName: Rule
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Contrast Protect/Analytic Rules/ContrastSuspicious.yaml
queryPeriod: 5m
query: |
  let extract_data=(a:string, k:string) {
    parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
  };

  CommonSecurityLog 
  | where DeviceVendor == "Contrast Security"
  | where AdditionalExtensions contains "SUSPICIOUS"
  | extend DeviceProduct
  | extend SourceIP
  | extend DeviceVersion
  | extend Activity
  | extend ApplicationProtocol
  | extend RequestURL
  | extend RequestMethod
  | extend Rule = extract_data(AdditionalExtensions, 'pri')  
requiredDataConnectors:
- connectorId: ContrastProtect
  dataTypes:
  - CommonSecurityLog
- connectorId: ContrastProtectAma
  dataTypes:
  - CommonSecurityLog
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
severity: Medium
name: Contrast Suspicious
tactics:
- InitialAccess
- Exfiltration
version: 1.0.2
status: Available
triggerOperator: gt
customDetails:
  Application: ApplicationProtocol
  Details: AdditionalExtensions
  AgentVersion: DeviceVersion
  Agent: DeviceProduct
  Attack: Activity
relevantTechniques:
- T1566

ARM