Skip to content

Commit f33ca10

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#13022 from Azure/v-sabiraj-Azurefirewallrules
Update analytic rule for TI destination detection
2 parents ecfb878 + cac8ad2 commit f33ca10

File tree

4 files changed

+43
-41
lines changed

4 files changed

+43
-41
lines changed

‎Solutions/Azure Firewall/Analytic Rules/Azure Firewall - Multiple Sources Affected by the Same TI Destination.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ query: |
3636
| parse msg_s with * "from " SourceIp ":" SourcePort:int " to " Fqdn ":" DestinationPort:int "." * "Action: Deny. " ThreatDescription),
3737
(AZFWThreatIntel
3838
| where TimeGenerated between (ago(StartRunTime) .. ago(EndRunTime)))
39+
| extend Fqdn = DestinationIp
3940
| summarize TiTrafficCount = count(), dCountSourceIps = dcount(SourceIp), AffectedIps = make_set(SourceIp, 10000) by Fqdn, ThreatDescription
4041
| where array_length(AffectedIps) > MinAffectedThreshold
4142
| mv-expand SourceIp = AffectedIps
@@ -49,5 +50,5 @@ entityMappings:
4950
fieldMappings:
5051
- identifier: Url
5152
columnName: Fqdn
52-
version: 1.1.3
53+
version: 1.1.4
5354
kind: Scheduled

‎Solutions/Azure Firewall/Package/3.0.5.zip‎

5 Bytes
Binary file not shown.

‎Solutions/Azure Firewall/Package/mainTemplate.json‎

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -154,11 +154,11 @@
154154
"_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b2c5907b-1040-4692-9802-9946031017e8','-', '1.1.2')))]"
155155
},
156156
"analyticRuleObject4": {
157-
"analyticRuleVersion4": "1.1.3",
157+
"analyticRuleVersion4": "1.1.4",
158158
"_analyticRulecontentId4": "4644baf7-3464-45dd-bd9d-e07687e25f81",
159159
"analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4644baf7-3464-45dd-bd9d-e07687e25f81')]",
160160
"analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4644baf7-3464-45dd-bd9d-e07687e25f81')))]",
161-
"_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4644baf7-3464-45dd-bd9d-e07687e25f81','-', '1.1.3')))]"
161+
"_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4644baf7-3464-45dd-bd9d-e07687e25f81','-', '1.1.4')))]"
162162
},
163163
"analyticRuleObject5": {
164164
"analyticRuleVersion5": "1.1.3",
@@ -4003,7 +4003,7 @@
40034003
],
40044004
"metadata": {
40054005
"comments": "This Azure Firewall connector uses Firewall, IP Groups and Firewall Policies APIs to perform different actions on the Firewall, IP Groups and Firewall Policies.",
4006-
"lastUpdateTime": "2025-08-28T17:57:43.001Z",
4006+
"lastUpdateTime": "2025-10-28T17:31:27.068Z",
40074007
"releaseNotes": {
40084008
"version": "1.0",
40094009
"title": "[variables('blanks')]",
@@ -6497,14 +6497,14 @@
64976497
"status": "Available",
64986498
"requiredDataConnectors": [
64996499
{
6500-
"connectorId": "AzureFirewall",
65016500
"dataTypes": [
65026501
"AzureDiagnostics",
65036502
"AZFWApplicationRule",
65046503
"AZFWNetworkRule",
65056504
"AZFWFlowTrace",
65066505
"AZFWIdpsSignature"
6507-
]
6506+
],
6507+
"connectorId": "AzureFirewall"
65086508
}
65096509
],
65106510
"tactics": [
@@ -6521,17 +6521,17 @@
65216521
{
65226522
"fieldMappings": [
65236523
{
6524-
"identifier": "Address",
6525-
"columnName": "SourceIp"
6524+
"columnName": "SourceIp",
6525+
"identifier": "Address"
65266526
}
65276527
],
65286528
"entityType": "IP"
65296529
},
65306530
{
65316531
"fieldMappings": [
65326532
{
6533-
"identifier": "Url",
6534-
"columnName": "Fqdn"
6533+
"columnName": "Fqdn",
6534+
"identifier": "Url"
65356535
}
65366536
],
65376537
"entityType": "URL"
@@ -6618,12 +6618,12 @@
66186618
"status": "Available",
66196619
"requiredDataConnectors": [
66206620
{
6621-
"connectorId": "AzureFirewall",
66226621
"dataTypes": [
66236622
"AzureDiagnostics",
66246623
"AZFWApplicationRule",
66256624
"AZFWNetworkRule"
6626-
]
6625+
],
6626+
"connectorId": "AzureFirewall"
66276627
}
66286628
],
66296629
"tactics": [
@@ -6636,17 +6636,17 @@
66366636
{
66376637
"fieldMappings": [
66386638
{
6639-
"identifier": "Address",
6640-
"columnName": "SourceIp"
6639+
"columnName": "SourceIp",
6640+
"identifier": "Address"
66416641
}
66426642
],
66436643
"entityType": "IP"
66446644
},
66456645
{
66466646
"fieldMappings": [
66476647
{
6648-
"identifier": "Url",
6649-
"columnName": "Fqdn"
6648+
"columnName": "Fqdn",
6649+
"identifier": "Url"
66506650
}
66516651
],
66526652
"entityType": "URL"
@@ -6733,12 +6733,12 @@
67336733
"status": "Available",
67346734
"requiredDataConnectors": [
67356735
{
6736-
"connectorId": "AzureFirewall",
67376736
"dataTypes": [
67386737
"AzureDiagnostics",
67396738
"AZFWApplicationRule",
67406739
"AZFWNetworkRule"
6741-
]
6740+
],
6741+
"connectorId": "AzureFirewall"
67426742
}
67436743
],
67446744
"tactics": [
@@ -6751,17 +6751,17 @@
67516751
{
67526752
"fieldMappings": [
67536753
{
6754-
"identifier": "Address",
6755-
"columnName": "SourceIp"
6754+
"columnName": "SourceIp",
6755+
"identifier": "Address"
67566756
}
67576757
],
67586758
"entityType": "IP"
67596759
},
67606760
{
67616761
"fieldMappings": [
67626762
{
6763-
"identifier": "Url",
6764-
"columnName": "Fqdn"
6763+
"columnName": "Fqdn",
6764+
"identifier": "Url"
67656765
}
67666766
],
67676767
"entityType": "URL"
@@ -6837,7 +6837,7 @@
68376837
"description": "Identifies multiple machines trying to reach out to the same destination blocked by TI in Azure Firewall. This can indicate attack on the organization by the same attack group.\n\nConfigurable Parameters:\n\n- Minimum affected threshold - alert only if more than this number of hosts affected. Default is set to 5.\n- Recommendation is to use the new resource specific logs. If you are using both, the TiTraffic Count will be duplicated.",
68386838
"displayName": "Multiple Sources Affected by the Same TI Destination",
68396839
"enabled": false,
6840-
"query": "let RunTime = 1d; \nlet StartRunTime = 1d; \nlet EndRunTime = StartRunTime - RunTime; \nlet MinAffectedThreshold = 5;\nunion isfuzzy=true\n(AzureDiagnostics \n| where TimeGenerated between (ago(StartRunTime) .. ago(EndRunTime))\n| where OperationName == \"AzureFirewallThreatIntelLog\"\n| parse msg_s with * \"from \" SourceIp \":\" SourcePort:int \" to \" Fqdn \":\" DestinationPort:int \".\" * \"Action: Deny. \" ThreatDescription),\n(AZFWThreatIntel\n| where TimeGenerated between (ago(StartRunTime) .. ago(EndRunTime)))\n| summarize TiTrafficCount = count(), dCountSourceIps = dcount(SourceIp), AffectedIps = make_set(SourceIp, 10000) by Fqdn, ThreatDescription\n| where array_length(AffectedIps) > MinAffectedThreshold\n| mv-expand SourceIp = AffectedIps\n| order by TiTrafficCount desc, Fqdn asc, parse_ipv4(tostring(SourceIp)) asc\n",
6840+
"query": "let RunTime = 1d; \nlet StartRunTime = 1d; \nlet EndRunTime = StartRunTime - RunTime; \nlet MinAffectedThreshold = 5;\nunion isfuzzy=true\n(AzureDiagnostics \n| where TimeGenerated between (ago(StartRunTime) .. ago(EndRunTime))\n| where OperationName == \"AzureFirewallThreatIntelLog\"\n| parse msg_s with * \"from \" SourceIp \":\" SourcePort:int \" to \" Fqdn \":\" DestinationPort:int \".\" * \"Action: Deny. \" ThreatDescription),\n(AZFWThreatIntel\n| where TimeGenerated between (ago(StartRunTime) .. ago(EndRunTime)))\n| extend Fqdn = DestinationIp\n| summarize TiTrafficCount = count(), dCountSourceIps = dcount(SourceIp), AffectedIps = make_set(SourceIp, 10000) by Fqdn, ThreatDescription\n| where array_length(AffectedIps) > MinAffectedThreshold\n| mv-expand SourceIp = AffectedIps\n| order by TiTrafficCount desc, Fqdn asc, parse_ipv4(tostring(SourceIp)) asc\n",
68416841
"queryFrequency": "P1D",
68426842
"queryPeriod": "P1D",
68436843
"severity": "Medium",
@@ -6848,11 +6848,11 @@
68486848
"status": "Available",
68496849
"requiredDataConnectors": [
68506850
{
6851-
"connectorId": "AzureFirewall",
68526851
"dataTypes": [
68536852
"AzureDiagnostics",
68546853
"AZFWThreatIntel"
6855-
]
6854+
],
6855+
"connectorId": "AzureFirewall"
68566856
}
68576857
],
68586858
"tactics": [
@@ -6867,17 +6867,17 @@
68676867
{
68686868
"fieldMappings": [
68696869
{
6870-
"identifier": "Address",
6871-
"columnName": "SourceIp"
6870+
"columnName": "SourceIp",
6871+
"identifier": "Address"
68726872
}
68736873
],
68746874
"entityType": "IP"
68756875
},
68766876
{
68776877
"fieldMappings": [
68786878
{
6879-
"identifier": "Url",
6880-
"columnName": "Fqdn"
6879+
"columnName": "Fqdn",
6880+
"identifier": "Url"
68816881
}
68826882
],
68836883
"entityType": "URL"
@@ -6964,12 +6964,12 @@
69646964
"status": "Available",
69656965
"requiredDataConnectors": [
69666966
{
6967-
"connectorId": "AzureFirewall",
69686967
"dataTypes": [
69696968
"AzureDiagnostics",
69706969
"AZFWApplicationRule",
69716970
"AZFWNetworkRule"
6972-
]
6971+
],
6972+
"connectorId": "AzureFirewall"
69736973
}
69746974
],
69756975
"tactics": [
@@ -6984,17 +6984,17 @@
69846984
{
69856985
"fieldMappings": [
69866986
{
6987-
"identifier": "Address",
6988-
"columnName": "SourceIp"
6987+
"columnName": "SourceIp",
6988+
"identifier": "Address"
69896989
}
69906990
],
69916991
"entityType": "IP"
69926992
},
69936993
{
69946994
"fieldMappings": [
69956995
{
6996-
"identifier": "Url",
6997-
"columnName": "Fqdn"
6996+
"columnName": "Fqdn",
6997+
"identifier": "Url"
69986998
}
69996999
],
70007000
"entityType": "URL"
@@ -7081,14 +7081,14 @@
70817081
"status": "Available",
70827082
"requiredDataConnectors": [
70837083
{
7084-
"connectorId": "AzureFirewall",
70857084
"dataTypes": [
70867085
"AzureDiagnostics",
70877086
"AZFWApplicationRule",
70887087
"AZFWNetworkRule",
70897088
"AZFWFlowTrace",
70907089
"AZFWIdpsSignature"
7091-
]
7090+
],
7091+
"connectorId": "AzureFirewall"
70927092
}
70937093
],
70947094
"tactics": [
@@ -7105,17 +7105,17 @@
71057105
{
71067106
"fieldMappings": [
71077107
{
7108-
"identifier": "Address",
7109-
"columnName": "SourceIp"
7108+
"columnName": "SourceIp",
7109+
"identifier": "Address"
71107110
}
71117111
],
71127112
"entityType": "IP"
71137113
},
71147114
{
71157115
"fieldMappings": [
71167116
{
7117-
"identifier": "Url",
7118-
"columnName": "Fqdn"
7117+
"columnName": "Fqdn",
7118+
"identifier": "Url"
71197119
}
71207120
],
71217121
"entityType": "URL"

‎Solutions/Azure Firewall/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|------------------------------------------------------------------------------------------|
3+
| 3.0.6 | 28-10-2025 | Enhanced the Azure Firewall analytic rule to extend Fqdn from DestinationIp for improved detection of Multiple Sources Affected by the Same TI Destination. |
34
| 3.0.5 | 26-07-2024 | Updated **Analytical Rule** for missing TTP |
45
| 3.0.4 | 12-02-2024 | Updated **Analytical Rule** |
56
| 3.0.3 | 17-01-2024 | Updated Azure Firewall **Data Connector** to support resource specific logs. |

0 commit comments

Comments
 (0)