Detection rules › Kusto
Cisco WSA - Internet access from public IP
'Detects internet access from public IP.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1189 Drive-by Compromise |
Rule body kusto
id: 4250b050-e1c6-4926-af04-9484bbd7e94f
name: Cisco WSA - Internet access from public IP
description: |
'Detects internet access from public IP.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1189
query: |
let ip_except = dynamic(['127.0.0.2']); //Add exceptions to this list
CiscoWSAEvent
| where ipv4_is_private(SrcIpAddr) == false
| extend IPCustomEntity = SrcIpAddr
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled
Stages and Predicates
Parameters
let ip_except = dynamic(['127.0.0.2']);
Stage 1: source
CiscoWSAEvent
Stage 2: where
| where ipv4_is_private(SrcIpAddr) == false
Stage 3: extend
| extend IPCustomEntity = SrcIpAddr
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
SrcIpAddr | cidr_match | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8 |
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
IPCustomEntity | extend |