diff --git a/Solutions/CiscoASA/Data/Solution_Cisco asa.json b/Solutions/CiscoASA/Data/Solution_Cisco asa.json index 1e68b8bd279..125dcfdf423 100644 --- a/Solutions/CiscoASA/Data/Solution_Cisco asa.json +++ b/Solutions/CiscoASA/Data/Solution_Cisco asa.json @@ -29,5 +29,5 @@ "Metadata": "SolutionMetadata.json", "TemplateSpec": false, "Is1PConnector": false, - "Version": "3.1.2" + "Version": "3.1.3" } diff --git a/Solutions/CiscoASA/Package/3.1.3.zip b/Solutions/CiscoASA/Package/3.1.3.zip new file mode 100644 index 00000000000..9bb713c5116 Binary files /dev/null and b/Solutions/CiscoASA/Package/3.1.3.zip differ diff --git a/Solutions/CiscoASA/Package/mainTemplate.json b/Solutions/CiscoASA/Package/mainTemplate.json index a689b9ca83a..d4d49782254 100644 --- a/Solutions/CiscoASA/Package/mainTemplate.json +++ b/Solutions/CiscoASA/Package/mainTemplate.json @@ -76,7 +76,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "CiscoASA", - "_solutionVersion": "3.1.2", + "_solutionVersion": "3.1.3", "solutionId": "azuresentinel.azure-sentinel-solution-ciscoasa", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.1.1", @@ -161,7 +161,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cisco Workbook with template version 3.1.2", + "description": "Cisco Workbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -250,7 +250,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA data connector with template version 3.1.2", + "description": "CiscoASA data connector with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -540,7 +540,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASAConnector Playbook with template version 3.1.2", + "description": "CiscoASAConnector Playbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -2700,7 +2700,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-AddIPtoNetworkObjectGroup Playbook with template version 3.1.2", + "description": "CiscoASA-AddIPtoNetworkObjectGroup Playbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -3468,7 +3468,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-CreateACEInACL Playbook with template version 3.1.2", + "description": "CiscoASA-CreateACEInACL Playbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -4250,7 +4250,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-CreateInboundAccessRuleOnInterface Playbook with template version 3.1.2", + "description": "CiscoASA-CreateInboundAccessRuleOnInterface Playbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -5032,7 +5032,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-ThreatDetectionMessage_AnalyticalRules Analytics Rule with template version 3.1.2", + "description": "CiscoASA-ThreatDetectionMessage_AnalyticalRules Analytics Rule with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -5060,10 +5060,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CiscoAsaAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CiscoAsaAma" + ] } ], "tactics": [ @@ -5078,8 +5078,8 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "FullName" } ], "entityType": "Host" @@ -5087,8 +5087,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -5148,7 +5148,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-PossibleDataExfiltration_AnalyticalRules Analytics Rule with template version 3.1.2", + "description": "CiscoASA-PossibleDataExfiltration_AnalyticalRules Analytics Rule with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -5176,10 +5176,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CiscoAsaAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CiscoAsaAma" + ] } ], "tactics": [ @@ -5193,8 +5193,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -5202,8 +5202,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "DestinationIP" + "columnName": "DestinationIP", + "identifier": "Address" } ], "entityType": "IP" @@ -5263,7 +5263,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-AvgAttackDetectRateIncrease_AnalyticalRules Analytics Rule with template version 3.1.2", + "description": "CiscoASA-AvgAttackDetectRateIncrease_AnalyticalRules Analytics Rule with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -5291,10 +5291,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CiscoAsaAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CiscoAsaAma" + ] } ], "tactics": [ @@ -5309,16 +5309,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "HostNameDomain" + "columnName": "HostNameDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -5326,8 +5326,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -5383,7 +5383,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.2", + "version": "3.1.3", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "CiscoASA", @@ -5461,17 +5461,17 @@ { "kind": "CustomDetection", "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", - "version": "3.1.0" + "version": "3.1.3" }, { "kind": "CustomDetection", "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", - "version": "3.1.0" + "version": "3.1.3" }, { "kind": "CustomDetection", "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", - "version": "3.1.0" + "version": "3.1.3" } ] }, @@ -5514,33 +5514,16 @@ "import": "MicrosoftSecurity", "type": "Microsoft.Security/detectionRules@2026-06-01-preview", "properties": { - "queryCondition": { - "queryText": "CommonSecurityLog\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID in (\"733101\",\"733102\",\"733103\",\"733104\",\"733105\")\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" - }, - "displayName": "Cisco ASA - threat detection message fired", - "id": "[if(true(), 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e', 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e')]", "schedule": { "frequency": "PT1H" }, - "status": "disabled", "detectionAction": { "alertTemplate": { "title": "Cisco ASA - threat detection message fired", - "tactics": [ - { - "techniques": [ - { - "technique": "T1046" - } - ], - "tactic": "Discovery" - } - ], "description": "'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105\nResources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", "customDetails": { "HostFullName": "DeviceName" }, - "severity": "medium", "entityMappings": { "ips": [ { @@ -5554,8 +5537,31 @@ "id": "[if(true(), 'host1', 'host1')]" } ] - } + }, + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1046" + } + ] + } + ], + "severity": "medium" } + }, + "status": "disabled", + "queryCondition": { + "queryText": "CommonSecurityLog\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID in (\"733101\",\"733102\",\"733103\",\"733104\",\"733105\")\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" + }, + "displayName": "Cisco ASA - threat detection message fired", + "id": "[if(true(), 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e', 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "contentVersion": "3.1.3" } } } @@ -5590,33 +5596,16 @@ "import": "MicrosoftSecurity", "type": "Microsoft.Security/detectionRules@2026-06-01-preview", "properties": { - "queryCondition": { - "queryText": "CommonSecurityLog\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID in (\"733101\",\"733102\",\"733103\",\"733104\",\"733105\")\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" - }, - "displayName": "Cisco ASA - threat detection message fired", - "id": "[if(true(), 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e', 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e')]", "schedule": { "frequency": "PT1H" }, - "status": "disabled", "detectionAction": { "alertTemplate": { "title": "Cisco ASA - threat detection message fired", - "tactics": [ - { - "techniques": [ - { - "technique": "T1046" - } - ], - "tactic": "Discovery" - } - ], "description": "'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105\nResources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", "customDetails": { "HostFullName": "DeviceName" }, - "severity": "medium", "entityMappings": { "ips": [ { @@ -5630,8 +5619,31 @@ "id": "[if(true(), 'host1', 'host1')]" } ] - } + }, + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1046" + } + ] + } + ], + "severity": "medium" } + }, + "status": "disabled", + "queryCondition": { + "queryText": "CommonSecurityLog\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID in (\"733101\",\"733102\",\"733103\",\"733104\",\"733105\")\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" + }, + "displayName": "Cisco ASA - threat detection message fired", + "id": "[if(true(), 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e', 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "contentVersion": "3.1.3" } } } @@ -5645,12 +5657,29 @@ "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", "contentKind": "CustomDetection", "displayName": "Cisco ASA - threat detection message fired", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e','-','3.1.0')))]", - "version": "3.1.0", - "dependency": { + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e','-','3.1.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e','-','3.1.3')))]", + "version": "3.1.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "contentVersion": "3.1.3", "requiredWorkloads": [ - "sentinel" + { + "dataTypes": [ + "CommonSecurityLog" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" + } ] } }, @@ -5683,18 +5712,25 @@ "import": "MicrosoftSecurity", "type": "Microsoft.Security/detectionRules@2026-06-01-preview", "properties": { - "queryCondition": { - "queryText": "let Lookback = 1h;\nlet MinUploadBytes = 1073741824;\nlet MinUploadRatio = 95.0;\nCommonSecurityLog\n| where TimeGenerated > ago(Lookback)\n| where DeviceProduct has_any (\"ASA\", \"FTD\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| where ipv4_is_private(SourceIP)\n| where not(ipv4_is_private(DestinationIP))\n| where DeviceAction in~ (\"allow\", \"allowed\", \"accept\", \"accepted\", \"permitted\")\n| extend SentBytesLong = tolong(SentBytes)\n| extend ReceivedBytesLong = tolong(ReceivedBytes)\n| where isnotnull(SentBytesLong)\n| summarize\n TotalBytesSent = sum(SentBytesLong),\n TotalBytesReceived = sum(coalesce(ReceivedBytesLong, 0)),\n Connections = count(),\n DestinationPorts = make_set(DestinationPort, 20),\n Applications = make_set(ApplicationProtocol, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SourceIP, DestinationIP\n| where TotalBytesSent >= MinUploadBytes\n| extend TotalGBSent = round(TotalBytesSent / 1024.0 / 1024.0 / 1024.0, 2)\n| extend TotalGBReceived = round(TotalBytesReceived / 1024.0 / 1024.0 / 1024.0, 2)\n| extend UploadRatio = round(todouble(TotalBytesSent) / todouble(TotalBytesSent + TotalBytesReceived) * 100, 2)\n| where UploadRatio >= MinUploadRatio\n| project\n TimeGenerated = LastSeen,\n SourceIP,\n DestinationIP,\n TotalGBSent,\n TotalGBReceived,\n UploadRatio,\n Connections,\n DestinationPorts,\n Applications,\n FirstSeen,\n LastSeen\n| order by TotalGBSent desc" - }, - "displayName": "Cisco ASA - Possible Data Exfiltration Detection", - "id": "[if(true(), 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72', 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72')]", "schedule": { "frequency": "PT1H" }, - "status": "disabled", "detectionAction": { "alertTemplate": { "severity": "medium", + "tactics": [ + { + "tactic": "Exfiltration", + "techniques": [ + { + "technique": "T1041" + }, + { + "technique": "T1048" + } + ] + } + ], "entityMappings": { "ips": [ { @@ -5708,21 +5744,20 @@ ] }, "title": "Cisco ASA - Possible Data Exfiltration Detection", - "tactics": [ - { - "techniques": [ - { - "technique": "T1041" - }, - { - "technique": "T1048" - } - ], - "tactic": "Exfiltration" - } - ], "description": "'Detects potential data exfiltration when an internal source IP sends a large amount of outbound data to the internet, especially when the volume is significantly higher than its normal behavior.'" } + }, + "status": "disabled", + "queryCondition": { + "queryText": "let Lookback = 1h;\nlet MinUploadBytes = 1073741824;\nlet MinUploadRatio = 95.0;\nCommonSecurityLog\n| where TimeGenerated > ago(Lookback)\n| where DeviceProduct has_any (\"ASA\", \"FTD\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| where ipv4_is_private(SourceIP)\n| where not(ipv4_is_private(DestinationIP))\n| where DeviceAction in~ (\"allow\", \"allowed\", \"accept\", \"accepted\", \"permitted\")\n| extend SentBytesLong = tolong(SentBytes)\n| extend ReceivedBytesLong = tolong(ReceivedBytes)\n| where isnotnull(SentBytesLong)\n| summarize\n TotalBytesSent = sum(SentBytesLong),\n TotalBytesReceived = sum(coalesce(ReceivedBytesLong, 0)),\n Connections = count(),\n DestinationPorts = make_set(DestinationPort, 20),\n Applications = make_set(ApplicationProtocol, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SourceIP, DestinationIP\n| where TotalBytesSent >= MinUploadBytes\n| extend TotalGBSent = round(TotalBytesSent / 1024.0 / 1024.0 / 1024.0, 2)\n| extend TotalGBReceived = round(TotalBytesReceived / 1024.0 / 1024.0 / 1024.0, 2)\n| extend UploadRatio = round(todouble(TotalBytesSent) / todouble(TotalBytesSent + TotalBytesReceived) * 100, 2)\n| where UploadRatio >= MinUploadRatio\n| project\n TimeGenerated = LastSeen,\n SourceIP,\n DestinationIP,\n TotalGBSent,\n TotalGBReceived,\n UploadRatio,\n Connections,\n DestinationPorts,\n Applications,\n FirstSeen,\n LastSeen\n| order by TotalGBSent desc" + }, + "displayName": "Cisco ASA - Possible Data Exfiltration Detection", + "id": "[if(true(), 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72', 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "contentVersion": "3.1.3" } } } @@ -5757,18 +5792,25 @@ "import": "MicrosoftSecurity", "type": "Microsoft.Security/detectionRules@2026-06-01-preview", "properties": { - "queryCondition": { - "queryText": "let Lookback = 1h;\nlet MinUploadBytes = 1073741824;\nlet MinUploadRatio = 95.0;\nCommonSecurityLog\n| where TimeGenerated > ago(Lookback)\n| where DeviceProduct has_any (\"ASA\", \"FTD\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| where ipv4_is_private(SourceIP)\n| where not(ipv4_is_private(DestinationIP))\n| where DeviceAction in~ (\"allow\", \"allowed\", \"accept\", \"accepted\", \"permitted\")\n| extend SentBytesLong = tolong(SentBytes)\n| extend ReceivedBytesLong = tolong(ReceivedBytes)\n| where isnotnull(SentBytesLong)\n| summarize\n TotalBytesSent = sum(SentBytesLong),\n TotalBytesReceived = sum(coalesce(ReceivedBytesLong, 0)),\n Connections = count(),\n DestinationPorts = make_set(DestinationPort, 20),\n Applications = make_set(ApplicationProtocol, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SourceIP, DestinationIP\n| where TotalBytesSent >= MinUploadBytes\n| extend TotalGBSent = round(TotalBytesSent / 1024.0 / 1024.0 / 1024.0, 2)\n| extend TotalGBReceived = round(TotalBytesReceived / 1024.0 / 1024.0 / 1024.0, 2)\n| extend UploadRatio = round(todouble(TotalBytesSent) / todouble(TotalBytesSent + TotalBytesReceived) * 100, 2)\n| where UploadRatio >= MinUploadRatio\n| project\n TimeGenerated = LastSeen,\n SourceIP,\n DestinationIP,\n TotalGBSent,\n TotalGBReceived,\n UploadRatio,\n Connections,\n DestinationPorts,\n Applications,\n FirstSeen,\n LastSeen\n| order by TotalGBSent desc" - }, - "displayName": "Cisco ASA - Possible Data Exfiltration Detection", - "id": "[if(true(), 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72', 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72')]", "schedule": { "frequency": "PT1H" }, - "status": "disabled", "detectionAction": { "alertTemplate": { "severity": "medium", + "tactics": [ + { + "tactic": "Exfiltration", + "techniques": [ + { + "technique": "T1041" + }, + { + "technique": "T1048" + } + ] + } + ], "entityMappings": { "ips": [ { @@ -5782,21 +5824,20 @@ ] }, "title": "Cisco ASA - Possible Data Exfiltration Detection", - "tactics": [ - { - "techniques": [ - { - "technique": "T1041" - }, - { - "technique": "T1048" - } - ], - "tactic": "Exfiltration" - } - ], "description": "'Detects potential data exfiltration when an internal source IP sends a large amount of outbound data to the internet, especially when the volume is significantly higher than its normal behavior.'" } + }, + "status": "disabled", + "queryCondition": { + "queryText": "let Lookback = 1h;\nlet MinUploadBytes = 1073741824;\nlet MinUploadRatio = 95.0;\nCommonSecurityLog\n| where TimeGenerated > ago(Lookback)\n| where DeviceProduct has_any (\"ASA\", \"FTD\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| where ipv4_is_private(SourceIP)\n| where not(ipv4_is_private(DestinationIP))\n| where DeviceAction in~ (\"allow\", \"allowed\", \"accept\", \"accepted\", \"permitted\")\n| extend SentBytesLong = tolong(SentBytes)\n| extend ReceivedBytesLong = tolong(ReceivedBytes)\n| where isnotnull(SentBytesLong)\n| summarize\n TotalBytesSent = sum(SentBytesLong),\n TotalBytesReceived = sum(coalesce(ReceivedBytesLong, 0)),\n Connections = count(),\n DestinationPorts = make_set(DestinationPort, 20),\n Applications = make_set(ApplicationProtocol, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SourceIP, DestinationIP\n| where TotalBytesSent >= MinUploadBytes\n| extend TotalGBSent = round(TotalBytesSent / 1024.0 / 1024.0 / 1024.0, 2)\n| extend TotalGBReceived = round(TotalBytesReceived / 1024.0 / 1024.0 / 1024.0, 2)\n| extend UploadRatio = round(todouble(TotalBytesSent) / todouble(TotalBytesSent + TotalBytesReceived) * 100, 2)\n| where UploadRatio >= MinUploadRatio\n| project\n TimeGenerated = LastSeen,\n SourceIP,\n DestinationIP,\n TotalGBSent,\n TotalGBReceived,\n UploadRatio,\n Connections,\n DestinationPorts,\n Applications,\n FirstSeen,\n LastSeen\n| order by TotalGBSent desc" + }, + "displayName": "Cisco ASA - Possible Data Exfiltration Detection", + "id": "[if(true(), 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72', 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "contentVersion": "3.1.3" } } } @@ -5810,12 +5851,29 @@ "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", "contentKind": "CustomDetection", "displayName": "Cisco ASA - Possible Data Exfiltration Detection", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72','-','3.1.0')))]", - "version": "3.1.0", - "dependency": { + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72','-','3.1.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72','-','3.1.3')))]", + "version": "3.1.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "contentVersion": "3.1.3", "requiredWorkloads": [ - "sentinel" + { + "dataTypes": [ + "CommonSecurityLog" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" + } ] } }, @@ -5848,33 +5906,16 @@ "import": "MicrosoftSecurity", "type": "Microsoft.Security/detectionRules@2026-06-01-preview", "properties": { - "queryCondition": { - "queryText": "let timeframe = 1h;\nlet last1h = CommonSecurityLog\n| where TimeGenerated >= ago(timeframe)\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend CurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend MaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend CurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend MaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend CumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize last1hCumTotal = sum(CumulativeTotal), last1hAvgRatePerSec = avg(CurrentAvgRatePerSec), last1hAvgBurstRatePerSec = avg(CurrentBurstRatePerSec) by DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlet prev6h = CommonSecurityLog\n| where TimeGenerated between (ago(6h) .. ago(1h))\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend prevCurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend prevMaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend prevCurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend prevMaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend prevCumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), prev6hCumTotal = sum(prevCumulativeTotal), prev6hAvgRatePerSec = avg(prevCurrentAvgRatePerSec), prev6hAvgBurstRatePerSec = avg(prevCurrentBurstRatePerSec)\nby DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlast1h | join (\n prev6h\n) on DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate\n| project StartTimeUtc, EndTimeUtc, DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate, last1hCumTotal, prev6hCumTotal, prev6hAvgCumTotal = prev6hCumTotal/6, last1hAvgRatePerSec, prev6hAvgRatePerSec, last1hAvgBurstRatePerSec, prev6hAvgBurstRatePerSec\n// Select only events that indicate a doubling of the expected rate in the last hour over the previous 6 hours\n| where last1hCumTotal > 2*prev6hAvgCumTotal or last1hAvgRatePerSec > 2*prev6hAvgRatePerSec or last1hAvgBurstRatePerSec > 2*prev6hAvgBurstRatePerSec\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" - }, - "displayName": "Cisco ASA - average attack detection rate increase", - "id": "[if(true(), 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1', 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1')]", "schedule": { "frequency": "PT1H" }, - "status": "disabled", "detectionAction": { "alertTemplate": { "title": "Cisco ASA - average attack detection rate increase", - "tactics": [ - { - "techniques": [ - { - "technique": "T1046" - } - ], - "tactic": "Discovery" - } - ], "description": "'This will help you determine if Cisco ASA devices are under heavier attack than normal over the last hour versus the previous 6 hours based on DeviceEventClassID 733100\nReferences: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", "customDetails": { "HostFullName": "DeviceName" }, - "severity": "low", "entityMappings": { "ips": [ { @@ -5884,13 +5925,36 @@ ], "hosts": [ { - "nameColumn": "HostName", "id": "[if(true(), 'host1', 'host1')]", - "dnsDomainColumn": "HostNameDomain" + "dnsDomainColumn": "HostNameDomain", + "nameColumn": "HostName" } ] - } + }, + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1046" + } + ] + } + ], + "severity": "low" } + }, + "status": "disabled", + "queryCondition": { + "queryText": "let timeframe = 1h;\nlet last1h = CommonSecurityLog\n| where TimeGenerated >= ago(timeframe)\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend CurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend MaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend CurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend MaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend CumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize last1hCumTotal = sum(CumulativeTotal), last1hAvgRatePerSec = avg(CurrentAvgRatePerSec), last1hAvgBurstRatePerSec = avg(CurrentBurstRatePerSec) by DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlet prev6h = CommonSecurityLog\n| where TimeGenerated between (ago(6h) .. ago(1h))\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend prevCurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend prevMaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend prevCurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend prevMaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend prevCumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), prev6hCumTotal = sum(prevCumulativeTotal), prev6hAvgRatePerSec = avg(prevCurrentAvgRatePerSec), prev6hAvgBurstRatePerSec = avg(prevCurrentBurstRatePerSec)\nby DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlast1h | join (\n prev6h\n) on DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate\n| project StartTimeUtc, EndTimeUtc, DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate, last1hCumTotal, prev6hCumTotal, prev6hAvgCumTotal = prev6hCumTotal/6, last1hAvgRatePerSec, prev6hAvgRatePerSec, last1hAvgBurstRatePerSec, prev6hAvgBurstRatePerSec\n// Select only events that indicate a doubling of the expected rate in the last hour over the previous 6 hours\n| where last1hCumTotal > 2*prev6hAvgCumTotal or last1hAvgRatePerSec > 2*prev6hAvgRatePerSec or last1hAvgBurstRatePerSec > 2*prev6hAvgBurstRatePerSec\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" + }, + "displayName": "Cisco ASA - average attack detection rate increase", + "id": "[if(true(), 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1', 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "contentVersion": "3.1.3" } } } @@ -5925,33 +5989,16 @@ "import": "MicrosoftSecurity", "type": "Microsoft.Security/detectionRules@2026-06-01-preview", "properties": { - "queryCondition": { - "queryText": "let timeframe = 1h;\nlet last1h = CommonSecurityLog\n| where TimeGenerated >= ago(timeframe)\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend CurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend MaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend CurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend MaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend CumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize last1hCumTotal = sum(CumulativeTotal), last1hAvgRatePerSec = avg(CurrentAvgRatePerSec), last1hAvgBurstRatePerSec = avg(CurrentBurstRatePerSec) by DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlet prev6h = CommonSecurityLog\n| where TimeGenerated between (ago(6h) .. ago(1h))\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend prevCurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend prevMaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend prevCurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend prevMaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend prevCumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), prev6hCumTotal = sum(prevCumulativeTotal), prev6hAvgRatePerSec = avg(prevCurrentAvgRatePerSec), prev6hAvgBurstRatePerSec = avg(prevCurrentBurstRatePerSec)\nby DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlast1h | join (\n prev6h\n) on DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate\n| project StartTimeUtc, EndTimeUtc, DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate, last1hCumTotal, prev6hCumTotal, prev6hAvgCumTotal = prev6hCumTotal/6, last1hAvgRatePerSec, prev6hAvgRatePerSec, last1hAvgBurstRatePerSec, prev6hAvgBurstRatePerSec\n// Select only events that indicate a doubling of the expected rate in the last hour over the previous 6 hours\n| where last1hCumTotal > 2*prev6hAvgCumTotal or last1hAvgRatePerSec > 2*prev6hAvgRatePerSec or last1hAvgBurstRatePerSec > 2*prev6hAvgBurstRatePerSec\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" - }, - "displayName": "Cisco ASA - average attack detection rate increase", - "id": "[if(true(), 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1', 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1')]", "schedule": { "frequency": "PT1H" }, - "status": "disabled", "detectionAction": { "alertTemplate": { "title": "Cisco ASA - average attack detection rate increase", - "tactics": [ - { - "techniques": [ - { - "technique": "T1046" - } - ], - "tactic": "Discovery" - } - ], "description": "'This will help you determine if Cisco ASA devices are under heavier attack than normal over the last hour versus the previous 6 hours based on DeviceEventClassID 733100\nReferences: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", "customDetails": { "HostFullName": "DeviceName" }, - "severity": "low", "entityMappings": { "ips": [ { @@ -5961,13 +6008,36 @@ ], "hosts": [ { - "nameColumn": "HostName", "id": "[if(true(), 'host1', 'host1')]", - "dnsDomainColumn": "HostNameDomain" + "dnsDomainColumn": "HostNameDomain", + "nameColumn": "HostName" } ] - } + }, + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1046" + } + ] + } + ], + "severity": "low" } + }, + "status": "disabled", + "queryCondition": { + "queryText": "let timeframe = 1h;\nlet last1h = CommonSecurityLog\n| where TimeGenerated >= ago(timeframe)\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend CurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend MaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend CurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend MaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend CumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize last1hCumTotal = sum(CumulativeTotal), last1hAvgRatePerSec = avg(CurrentAvgRatePerSec), last1hAvgBurstRatePerSec = avg(CurrentBurstRatePerSec) by DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlet prev6h = CommonSecurityLog\n| where TimeGenerated between (ago(6h) .. ago(1h))\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend prevCurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend prevMaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend prevCurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend prevMaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend prevCumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), prev6hCumTotal = sum(prevCumulativeTotal), prev6hAvgRatePerSec = avg(prevCurrentAvgRatePerSec), prev6hAvgBurstRatePerSec = avg(prevCurrentBurstRatePerSec)\nby DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlast1h | join (\n prev6h\n) on DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate\n| project StartTimeUtc, EndTimeUtc, DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate, last1hCumTotal, prev6hCumTotal, prev6hAvgCumTotal = prev6hCumTotal/6, last1hAvgRatePerSec, prev6hAvgRatePerSec, last1hAvgBurstRatePerSec, prev6hAvgBurstRatePerSec\n// Select only events that indicate a doubling of the expected rate in the last hour over the previous 6 hours\n| where last1hCumTotal > 2*prev6hAvgCumTotal or last1hAvgRatePerSec > 2*prev6hAvgRatePerSec or last1hAvgBurstRatePerSec > 2*prev6hAvgBurstRatePerSec\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" + }, + "displayName": "Cisco ASA - average attack detection rate increase", + "id": "[if(true(), 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1', 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "contentVersion": "3.1.3" } } } @@ -5981,12 +6051,29 @@ "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", "contentKind": "CustomDetection", "displayName": "Cisco ASA - average attack detection rate increase", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1','-','3.1.0')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1','-','3.1.0')))]", - "version": "3.1.0", - "dependency": { + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1','-','3.1.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1','-','3.1.3')))]", + "version": "3.1.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "contentVersion": "3.1.3", "requiredWorkloads": [ - "sentinel" + { + "dataTypes": [ + "CommonSecurityLog" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" + } ] } }, diff --git a/Solutions/CiscoASA/ReleaseNotes.md b/Solutions/CiscoASA/ReleaseNotes.md index b064208b62b..f33b06a2c87 100644 --- a/Solutions/CiscoASA/ReleaseNotes.md +++ b/Solutions/CiscoASA/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|------------------------------------------------------------------------------| +| 3.1.3 | 13-10-2026 | Added workload, data-type, and connector prerequisite records to all three disabled XDR Custom Detections. Updated XDR content versions to 3.1.3 and V3.1 packaging to include resolved package/content provenance in installation and Content Hub registration records. | | 3.1.2 | 12-10-2026 | Refreshed the V3.1 hybrid package for three disabled Defender XDR Custom Detections with reviewed Host mappings and source-rule provenance. | | 3.1.1 | 11-10-2026 | Added a reviewed Host mapping to the threat-message Custom Detection and recorded accepted Host-mapping assumptions while preserving original host values in alert details. | | 3.1.0 | 11-10-2026 | Added three disabled Defender XDR Custom Detections with source-rule provenance and V3.1 hybrid packaging support. | diff --git a/Solutions/CiscoASA/SolutionMetadata.json b/Solutions/CiscoASA/SolutionMetadata.json index a66f67fb93a..fda2ab8ab4d 100644 --- a/Solutions/CiscoASA/SolutionMetadata.json +++ b/Solutions/CiscoASA/SolutionMetadata.json @@ -18,5 +18,5 @@ "email": "support@microsoft.com", "link": "https://support.microsoft.com/" }, - "version": "3.1.2" + "version": "3.1.3" } diff --git a/Solutions/CiscoASA/XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml b/Solutions/CiscoASA/XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml index af37a956cba..5f5ff05f73c 100644 --- a/Solutions/CiscoASA/XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml +++ b/Solutions/CiscoASA/XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml @@ -1,5 +1,5 @@ schemaVersion: 1.0.0 -version: 3.1.0 +version: 3.1.3 kind: CustomDetection resourceType: Microsoft.Security/detectionRules apiVersion: 2026-06-01-preview @@ -8,6 +8,15 @@ requiredDataConnectors: dataTypes: - CommonSecurityLog contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false source: platform: Microsoft Sentinel kind: AnalyticsRule diff --git a/Solutions/CiscoASA/XDR Detections/CiscoASA-PossibleDataExfiltration.yaml b/Solutions/CiscoASA/XDR Detections/CiscoASA-PossibleDataExfiltration.yaml index 33060261bca..0f8d0e8f68a 100644 --- a/Solutions/CiscoASA/XDR Detections/CiscoASA-PossibleDataExfiltration.yaml +++ b/Solutions/CiscoASA/XDR Detections/CiscoASA-PossibleDataExfiltration.yaml @@ -1,5 +1,5 @@ schemaVersion: 1.0.0 -version: 3.1.0 +version: 3.1.3 kind: CustomDetection resourceType: Microsoft.Security/detectionRules apiVersion: 2026-06-01-preview @@ -8,6 +8,15 @@ requiredDataConnectors: dataTypes: - CommonSecurityLog contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false source: platform: Microsoft Sentinel kind: AnalyticsRule diff --git a/Solutions/CiscoASA/XDR Detections/CiscoASA-ThreatDetectionMessage.yaml b/Solutions/CiscoASA/XDR Detections/CiscoASA-ThreatDetectionMessage.yaml index ac725e7c456..381502539b3 100644 --- a/Solutions/CiscoASA/XDR Detections/CiscoASA-ThreatDetectionMessage.yaml +++ b/Solutions/CiscoASA/XDR Detections/CiscoASA-ThreatDetectionMessage.yaml @@ -1,5 +1,5 @@ schemaVersion: 1.0.0 -version: 3.1.0 +version: 3.1.3 kind: CustomDetection resourceType: Microsoft.Security/detectionRules apiVersion: 2026-06-01-preview @@ -8,6 +8,15 @@ requiredDataConnectors: dataTypes: - CommonSecurityLog contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false source: platform: Microsoft Sentinel kind: AnalyticsRule