Microsoft Sentinel high experimental kql

Cisco SDWAN - Monitor Critical IPs

'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'

View Source

Detection Logic

CiscoSyslogUTD
| union (CiscoSDWANNetflow)
| where isnotempty(SourceIP) or isnotempty(NetflowFwSrcAddrIpv4)
| extend SourceIP = coalesce(SourceIP, NetflowFwSrcAddrIpv4)
| where ipv4_is_in_any_range(SourceIP, "Enter comma-separated IPs")
| summarize count() by SourceIP

Field Validations

Loading…

Comments (0)

Loading comments...