Detection rules › Kusto
Cisco SDWAN - Monitor Critical IPs
'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Rule body
id: a62a207e-62be-4a74-acab-4466d5b3854f
name: Cisco SDWAN - Monitor Critical IPs
description: |
'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: CiscoSDWAN
dataTypes:
- CiscoSyslogUTD
- connectorId: CiscoSDWAN
dataTypes:
- CiscoSDWANNetflow
queryFrequency: 3h
queryPeriod: 3h
triggerOperator: gt
triggerThreshold: 0
tactics:
- CommandAndControl
relevantTechniques:
- T1071
query: |
CiscoSyslogUTD
| union (CiscoSDWANNetflow)
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
| summarize count() by SourceIP
incidentConfiguration:
createIncident: true
eventGroupingSettings:
aggregationKind: AlertPerResult
customDetails:
"critical_ip": "SourceIP"
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIP
version: 1.0.1
kind: Scheduled
Stages and Predicates
Stage 1: source
CiscoSyslogUTD
Stage 2: union
| union
Stage 3: source
CiscoSDWANNetflow
Stage 4: where
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
Stage 5: extend
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
Stage 6: where
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
Stage 7: summarize
| summarize count() by SourceIP
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
NetflowFwSrcAddrIpv4 | is_not_null | field:"NetflowFwSrcAddrIpv4" kind:is_not_null | |
SourceIP | is_not_null | field:"SourceIP" kind:is_not_null |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
SourceIP | summarize |