Sagan medium stable other

[MSAPI-MICROSOFTFLOW-GEOIP] Flow action from outside HOME_COUNTRY

[MSAPI-MICROSOFTFLOW-GEOIP] Flow action from outside HOME_COUNTRY

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[MSAPI-MICROSOFTFLOW-GEOIP] Flow action from outside HOME_COUNTRY"; content:"ClientIP"; json_content: ".Workload","MicrosoftFlow"; country_code: track by_src, isnot $HOME_COUNTRY; json_map: "src_ip", ".ClientIP"; json_map: "dest_ip", ".ClientIP"; json_map: "username", ".UserId"; json_map: "program",".Workload"; classtype: suspicious-traffic; sid:5004884; rev: 2; metadata:updated_at 2023_08_01;)

Field Validations

Loading…

Comments (0)

Loading comments...