Detection rules › Panther

Panther rules: domain

Rule	Severity
Cisco Umbrella Domain Blocked	`low`

Cisco Umbrella Domain Blocked

Severity: low
Log types: CiscoUmbrella.DNS
Tags: DNS
Reference: support.umbrella.com
Source: github.com/panther-labs/panther-analysis

Monitor blocked domains

Detection logic

def rule(event):
    return event.get("action") == "Blocked"


def title(event):
    return "Access denied to domain " + event.get("domain", "<UNKNOWN_DOMAIN>")

Rule specification

AnalysisType: rule
Filename: domain_blocked.py
RuleID: "CiscoUmbrella.DNS.Blocked"
DisplayName: "Cisco Umbrella Domain Blocked"
Enabled: true
DedupPeriodMinutes: 480 # 8 hours
LogTypes:
  - CiscoUmbrella.DNS
Tags:
  - DNS
Severity: Low
Description: Monitor blocked domains
Runbook: Inspect the blocked domain and lookup for malware
Reference: https://support.umbrella.com/hc/en-us/articles/230563627-How-to-determine-if-a-domain-or-resource-is-being-blocked-using-Chrome-Net-Internals
SummaryAttributes:
  - action
  - internalIp
  - externalIp
  - domain
  - responseCode

Stages and Predicates

Fires on CiscoUmbrella.DNS events when the condition below holds.

Condition

action is Blocked

Alert deduplication: repeat matches within 8h group into one alert

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`Blocked`	`field:"action" kind:eq value:"Blocked"`

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

Field
`domain`

Response runbook

Inspect the blocked domain and lookup for malware

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event

{
  "action": "Blocked",
  "domain": "malware.gvt2.com.",
  "externalIp": "136.24.229.58",
  "internalIp": "136.24.229.58",
  "responseCode": "NOERROR",
  "timestamp": "2020-05-21 19:20:25.000"
}