detection.wiki

Detection rules › Kusto

Datawiza - massive errors detected

Severity
medium
Time window
10m
Source
github.com/Azure/Azure-Sentinel

"This rule is designed to identify when the system is experiencing abnormal errors."

MITRE ATT&CK coverage

TacticTechniques
Discovery

Rule body

id: "ddee1398-cf0b-46af-b583-78c3c29156dc"
name: "Datawiza - massive errors detected"
description: |
  "This rule is designed to identify when the system is experiencing abnormal errors."
severity: Medium
requiredDataConnectors:
  - connectorId: DatawizaDapSolution
    dataTypes:
      - datawizaserveraccess_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: GreaterThan
triggerThreshold: 0
tactics: 
  - Discovery
relevantTechniques:
  - T1082
query: |
    let timeFrame = 10m;
    datawizaserveraccess_CL
    | where TimeGenerated between (ago(timeFrame) .. now())
      and Status_d >= 500
    | summarize Count = count()
    | where Count > 100
eventGroupingSettings:
    aggregationKind: SingleAlert
alertDetailsOverride:
    alertDisplayNameFormat: 'Datawiza Massive Error Detection'
    alertDescriptionFormat: >
      Detected {{Count}} errors within 10 minutes. Please investigate unauthorized access attempts or misconfigurations.
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let timeFrame = 10m;

Stage 1: source

datawizaserveraccess_CL

Stage 2: where

| where TimeGenerated between (ago(timeFrame) .. now())
  and Status_d >= 500

Stage 3: summarize

| summarize Count = count()

Stage 4: where

| where Count > 100

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Countgt
  • 100
field:"Count" kind:gt value:"100"
Status_dge
  • 500
field:"Status_d" kind:ge value:"500"

Output fields

These fields are emitted when the rule matches.

FieldSource
Countsummarize