Detection rules › Kusto

Contrast ADR - WAF Alert Correlation

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: medium
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Stealth	`T1211` Exploitation for Stealth
Command & Control	`T1008` Fallback Channels

Rule body

id: 93641436-afb3-4921-8828-ceab0d15aaab
name: Contrast ADR - WAF Alert Correlation
description: |
  'Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: ContrastADRCCF
    dataTypes:
      - ContrastADRAttackEvents_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - DefenseEvasion
  - CommandAndControl
relevantTechniques:
  - T1190
  - T1211
  - T1008
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "exploited" or result =~ "blocked"
  | project-rename ip=sourceIp
  //please add you WAF table in place of ContrastWAFLogs_CL and WAF tables source IP or target IP column's inplace of ip and uncomment the queries below
  //| join kind=inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on ip
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ip
alertDetailsOverride:
  alertDisplayNameFormat: 'WAF Alert Confirmed {{result}}  by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} '
  alertDescriptionFormat: 'WAF Alert Confirmed {{result}}  by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} '
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT1H
    matchingMethod: Selected
    groupByEntities:
      - IP
eventGroupingSettings:
  aggregationKind: AlertPerResult
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

ContrastADRAttackEvents_CL

Stage 2: `where`

| where result =~ "exploited" or result =~ "blocked"

Stage 3: `project-rename`

| project-rename ip=sourceIp

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`result`	eq	`blocked` `exploited`	`field:"result" kind:eq`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ip`	`project-rename`