Detection rules › Kusto

Cisco SDWAN - Monitor Critical IPs

Status
available
Severity
high
Time window
3h
Group by
SourceIP
Source
github.com/Azure/Azure-Sentinel

'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'

MITRE ATT&CK coverage

TacticTechniques
Command & Control

Rule body

id: a62a207e-62be-4a74-acab-4466d5b3854f
name: Cisco SDWAN - Monitor Critical IPs
description: |
  'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CiscoSDWAN
    dataTypes:
      - CiscoSyslogUTD
  - connectorId: CiscoSDWAN
    dataTypes:
      - CiscoSDWANNetflow
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
query: |
  CiscoSyslogUTD
  | union (CiscoSDWANNetflow)
  | where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
  | extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
  | where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
  | summarize count() by SourceIP
incidentConfiguration:
  createIncident: true
eventGroupingSettings:
    aggregationKind: AlertPerResult
customDetails:
  "critical_ip": "SourceIP"
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: source

CiscoSyslogUTD

Stage 2: union

| union

Stage 3: source

CiscoSDWANNetflow

Stage 4: where

| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)

Stage 5: extend

| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)

Stage 6: where

| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")

Stage 7: summarize

| summarize count() by SourceIP

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
NetflowFwSrcAddrIpv4is_not_null
  • (no value, null check)
field:"NetflowFwSrcAddrIpv4" kind:is_not_null
SourceIPis_not_null
  • (no value, null check)
field:"SourceIP" kind:is_not_null

Output fields

These fields are emitted when the rule matches.

FieldSource
SourceIPsummarize