Microsoft Sentinel high experimental kql

CTERA Mass Access Denied Detection Analytic

This analytic rule detects and alerts when access denied operations generated by the CTERA Edge Filer goes over a predefined threshold

View Source

Detection Logic

Syslog
| where ProcessName == 'gw-audit'
| extend
    TenantName = extract("\"vportal\":\"([^\"]*)\"", 1, SyslogMessage),
    UserName = extract("user=([^
| ]*)", 1, SyslogMessage),
    Operation = extract("op=([^
| ]*)", 1, SyslogMessage),
    EdgeFiler = extract("\"client\":\"([^\"]*)\"", 1, SyslogMessage),
    RootPath = extract("rootPath=([^
| ]*)", 1, SyslogMessage),
    Share = extract("share=([^
| ]*)", 1, SyslogMessage),
    LocalPath = extract("path=([^
| ]*)", 1, SyslogMessage),
    Timestamp = todatetime(extract("\"@timestamp\":\"([^\"]*)\"", 1, SyslogMessage))
| where Operation in ('OpenDenied', 'createDenied', 'AclDenied', 'deleteDenied')
| summarize Count = count() by bin(Timestamp, 5m), UserName, EdgeFiler
| where Count > 1000

Field Validations

Loading…

Comments (0)

Loading comments...