detection.wiki

Detection rules › Kusto

Contrast ADR - WAF Alert Correlation

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status
available
Severity
medium
Time window
5m
Source
github.com/Azure/Azure-Sentinel

'Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.'

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application
StealthT1211 Exploitation for Stealth
Command & ControlT1008 Fallback Channels

Rule body kusto

id: 93641436-afb3-4921-8828-ceab0d15aaab
name: Contrast ADR - WAF Alert Correlation
description: |
  'Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: ContrastADRCCF
    dataTypes:
      - ContrastADRAttackEvents_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - DefenseEvasion
  - CommandAndControl
relevantTechniques:
  - T1190
  - T1211
  - T1008
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "exploited" or result =~ "blocked"
  | project-rename ip=sourceIp
  //please add you WAF table in place of ContrastWAFLogs_CL and WAF tables source IP or target IP column's inplace of ip and uncomment the queries below
  //| join kind=inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on ip
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ip
alertDetailsOverride:
  alertDisplayNameFormat: 'WAF Alert Confirmed {{result}}  by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} '
  alertDescriptionFormat: 'WAF Alert Confirmed {{result}}  by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} '
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT1H
    matchingMethod: Selected
    groupByEntities:
      - IP
eventGroupingSettings:
  aggregationKind: AlertPerResult
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: source

ContrastADRAttackEvents_CL

Stage 2: where

| where result =~ "exploited" or result =~ "blocked"

Stage 3: project-rename

| project-rename ip=sourceIp

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
resulteq
  • blocked
  • exploited

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
ipproject-rename