Detection rules › Kusto
Cisco WSA - Access to unwanted site
'Detects when users attempting to access sites from high risk category.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 38029e86-030c-46c4-8a91-a2be7c74d74c
name: Cisco WSA - Access to unwanted site
description: |
'Detects when users attempting to access sites from high risk category.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);
CiscoWSAEvent
| where UrlCategory in~ (risky_sites)
| where DvcAction =~ 'DEFAULT_CASE'
| extend AccountCustomEntity = SrcUserName
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountCustomEntity
version: 1.0.3
kind: Scheduled
Stages and Predicates
Parameters
let risky_sites = dynamic(['IW_adlt', 'IW_hack', 'IW_porn']);
Stage 1: source
CiscoWSAEvent
Stage 2: where
| where UrlCategory in~ (risky_sites)
Stage 3: where
| where DvcAction =~ 'DEFAULT_CASE'
Stage 4: extend
| extend AccountCustomEntity = SrcUserName
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DvcAction | eq |
| field:"DvcAction" kind:eq value:"DEFAULT_CASE" |
UrlCategory | in |
| field:"UrlCategory" kind:in |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
AccountCustomEntity | extend |