Detection rules › Kusto

Datawiza - massive errors detected

Severity
medium
Time window
10m
Source
github.com/Azure/Azure-Sentinel

"This rule is designed to identify when the system is experiencing abnormal errors."

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1082 System Information Discovery

Rule body kusto

id: "ddee1398-cf0b-46af-b583-78c3c29156dc"
name: "Datawiza - massive errors detected"
description: |
  "This rule is designed to identify when the system is experiencing abnormal errors."
severity: Medium
requiredDataConnectors:
  - connectorId: DatawizaDapSolution
    dataTypes:
      - datawizaserveraccess_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: GreaterThan
triggerThreshold: 0
tactics: 
  - Discovery
relevantTechniques:
  - T1082
query: |
    let timeFrame = 10m;
    datawizaserveraccess_CL
    | where TimeGenerated between (ago(timeFrame) .. now())
      and Status_d >= 500
    | summarize Count = count()
    | where Count > 100
eventGroupingSettings:
    aggregationKind: SingleAlert
alertDetailsOverride:
    alertDisplayNameFormat: 'Datawiza Massive Error Detection'
    alertDescriptionFormat: >
      Detected {{Count}} errors within 10 minutes. Please investigate unauthorized access attempts or misconfigurations.
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let timeFrame = 10m;

Stage 1: source

datawizaserveraccess_CL

Stage 2: where

| where TimeGenerated between (ago(timeFrame) .. now())
  and Status_d >= 500

Stage 3: summarize

| summarize Count = count()
Threshold
gt 100

Stage 4: where

| where Count > 100

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Countgt
  • 100 transforms: cased
Status_dge
  • 500 transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
Countsummarize