Contrast Probes

id: 297596de-d9ae-4fb8-b6ff-00fc01c9462d
name: Contrast Probes
description: |
  'Creates Incidents for Probed events sourced from the Contrast Protect agent.'
severity: Informational
requiredDataConnectors:
  - connectorId: ContrastProtect
    dataTypes:
      - CommonSecurityLog
  - connectorId: ContrastProtectAma
    dataTypes:
      - CommonSecurityLog
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 10
status: Available
tactics:
  - InitialAccess
  - Exfiltration
relevantTechniques:
  - T1566
query: |
  let extract_data=(a:string, k:string) {
    parse_urlquery(replace(@';', @'&', a))["Query Parameters"][k]
  };
  
  CommonSecurityLog 
  | where DeviceVendor == "Contrast Security"
  | where AdditionalExtensions contains "PROBED" or AdditionalExtensions contains "INEFFECTIVE"
  | extend DeviceProduct
  | extend SourceIP
  | extend DeviceVersion
  | extend Activity
  | extend ApplicationProtocol
  | extend RequestURL
  | extend RequestMethod
  | extend Rule = extract_data(AdditionalExtensions, 'pri')
customDetails:
  Application: ApplicationProtocol
  Agent: DeviceProduct
  AgentVersion: DeviceVersion
  Attack: Activity
  Details: AdditionalExtensions
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: RequestURL
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: ApplicationProtocol
  - entityType: Malware
    fieldMappings:
      - identifier: Name
        columnName: Activity
      - identifier: Category
        columnName: Rule
version: 1.0.2
kind: Scheduled