PaloAlto - Possible flooding

Back


Id	feb185cc-51f4-11ec-bf63-0242ac130002
Rulename	PaloAlto - Possible flooding
Description	Detects possible flooding.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleFlooding.yaml
Version	1.0.4
Arm template	feb185cc-51f4-11ec-bf63-0242ac130002.json

KQL

PaloAltoCDLEvent
| where EventResourceId =~ 'TRAFFIC'
| where isnotempty(NetworkSessionId)
| where DstBytes == 0 and tolong(NetworkPackets) > 0
| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoCDL/Analytic Rules/PaloAltoCDLPossibleFlooding.yaml
queryPeriod: 1h
version: 1.0.4
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
relevantTechniques:
- T1190
- T1133
queryFrequency: 1h
triggerOperator: gt
kind: Scheduled
query: |
  PaloAltoCDLEvent
  | where EventResourceId =~ 'TRAFFIC'
  | where isnotempty(NetworkSessionId)
  | where DstBytes == 0 and tolong(NetworkPackets) > 0
  | extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr  
id: feb185cc-51f4-11ec-bf63-0242ac130002
tactics:
- InitialAccess
status: Available
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
triggerThreshold: 0
name: PaloAlto - Possible flooding
severity: Medium
description: |
    'Detects possible flooding.'

ARM