Cisco SDWAN - Intrusion Events

Status: available
Severity: high
Time window: 3h
Source: github.com/Azure/Azure-Sentinel

'This Analytic rule will monitor Intrusion events in Cisco syslog data based on the provided Signature ID. This will create an incident if that Signature ID is found in the specified time range.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1189` Drive-by Compromise `T1190` Exploit Public-Facing Application

Rule body

id: 232a1c75-63fc-4c81-8b18-b4a739fccba8
name: Cisco SDWAN - Intrusion Events
description: |
  'This Analytic rule will monitor Intrusion events in Cisco syslog data based on the provided Signature ID. This will create an incident if that Signature ID is found in the specified time range.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CiscoSDWAN
    dataTypes:
      - CiscoSyslogUTD
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
  - T1189
query: |
  CiscoSyslogUTD
  | where SignatureId == "Enter SignatureId"
  | distinct SignatureId,SourceIP
incidentConfiguration:
  createIncident: true
eventGroupingSettings:
    aggregationKind: AlertPerResult
customDetails:
  signatureid: SignatureId
entityMappings:
  - entityType: RegistryKey
    fieldMappings:
      - identifier: Key
        columnName: SignatureId
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CiscoSyslogUTD

Stage 2: `where`

| where SignatureId == "Enter SignatureId"

Stage 3: `distinct`

| distinct SignatureId,SourceIP

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SignatureId`	eq	`Enter SignatureId`	`field:"SignatureId" kind:eq value:"Enter SignatureId"`