Sagan medium stable other

[MSAPI-MICROSOFTFLOW-BLUEDOT] Flow action from Bluedot listed IP address

[MSAPI-MICROSOFTFLOW-BLUEDOT] Flow action from Bluedot listed IP address

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[MSAPI-MICROSOFTFLOW-BLUEDOT] Flow action from Bluedot listed IP address"; content:"ClientIP"; json_content: ".Workload","MicrosoftFlow"; bluedot: type ip_reputation, track by_src, mdate_effective_period 3 months, Malicious,Tor,Honeypot,Proxy; json_map: "src_ip", ".ClientIP"; json_map: "dest_ip", ".ClientIP"; json_map: "username", ".UserId"; json_map: "program",".Workload"; classtype: suspicious-traffic; sid:5004887; rev: 2; metadata:updated_at 2023_08_01;)

Field Validations

Loading…

Comments (0)

Loading comments...