Detection rules › Kusto
Cisco WSA - Internet access from public IP
'Detects internet access from public IP.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 4250b050-e1c6-4926-af04-9484bbd7e94f
name: Cisco WSA - Internet access from public IP
description: |
'Detects internet access from public IP.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1189
query: |
let ip_except = dynamic(['127.0.0.2']); //Add exceptions to this list
CiscoWSAEvent
| where ipv4_is_private(SrcIpAddr) == false
| extend IPCustomEntity = SrcIpAddr
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled
Stages and Predicates
Parameters
let ip_except = dynamic(['127.0.0.2']);
Stage 1: source
CiscoWSAEvent
Stage 2: where
| where ipv4_is_private(SrcIpAddr) == false
Stage 3: extend
| extend IPCustomEntity = SrcIpAddr
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
SrcIpAddr | cidr_match | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8 | excludes:SrcIpAddr |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
IPCustomEntity | extend |