MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1499 Endpoint Denial of Service |
Rule body kusto
id: b808063b-07d5-432c-95d0-8900da61cce9
name: API - Rate limiting
description: |
'42Crunch API protection against rate limiting'
severity: Medium
requiredDataConnectors:
- connectorId: 42CrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
- connectorId: FortyTwoCrunchAPIProtection
dataTypes:
- FortyTwoCrunchAPIProtection
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: SingleAlert
status: Available
tactics:
- Impact
relevantTechniques:
- T1499
query: |
let firstRec = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m)
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
| where UriPath has "/api/login" and Status == 429;
let rateLimitCount = (toscalar(firstRec | count));
let recCount = iff((rateLimitCount > 20), 1, 0);
firstRec | top recCount by Timestamp desc;
customDetails:
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIp
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Hostname
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: InstanceName
version: 3.0.1
kind: Scheduled
Stages and Predicates
Parameters
let recCount = iff((rateLimitCount > 20), 1, 0);
Let binding: rateLimitCount
let rateLimitCount = (toscalar(firstRec | count));
Derived from firstRec.
The stages below define let firstRec (the rule's main pipeline source).
Stage 1: source
FortyTwoCrunchAPIProtection
Stage 2: where
| where TimeGenerated >= ago(5m)
Stage 3: project-away
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid
Stage 4: where
| where UriPath has "/api/login" and Status == 429
The stages below run on firstRec (the outer pipeline).
Stage 5: top
firstRec
| top recCount by Timestamp desc;
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.