CiscoWSAMultipleErrorsToUrl.yaml

id: 1db49647-435c-41ad-bf8c-7130ba75429d
name: Cisco WSA - Multiple errors to URL
description: |
  'Detects multiple connection errors to URL.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CiscoWSA
    dataTypes:
      - CiscoWSAEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
relevantTechniques:
  - T1102
query: |
  let threshold = 5;
  CiscoWSAEvent
  | where DvcAction =~ 'NONE'
  | summarize count() by SrcUserName, UrlOriginal, bin(TimeGenerated, 5m)
  | where count_ >= threshold
  | extend URLCustomEntity = UrlOriginal, AccountCustomEntity = SrcUserName
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: URLCustomEntity
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled