Cisco Umbrella Dns Cl Monitored Category Dns Query Filter Avoidance
KQL detection rule by ep3p · MIT
No description provided
let query_frequency = 1d;
let query_period = 14d;
let avoidance_categories = dynamic([
"DoH and DoT",
"Dynamic and Residential",
"Filter Avoidance",
"Personal VPN",
"Proxy/Anonymizer"
]);
let _ExpectedBlockedDomainsPartial = toscalar(
_GetWatchlist("Activity-ExpectedSignificantActivity")
| where Activity == "ExpectedBlockedDomain" and Notes has "[PartialDomain]"
| summarize RegEx = make_list(regex_quote(DestinationAddress))
| extend RegEx = strcat(@'\.(', strcat_array(RegEx, '|'), @')$')
);
let _ExpectedBlockedDomainsComplete = toscalar(
_GetWatchlist("Activity-ExpectedSignificantActivity")
| where Activity == "ExpectedBlockedDomain" and Notes has "[CompleteDomain]"
| summarize make_list(DestinationAddress)
);
CiscoUmbrellaLogs
| where TimeGenerated between (ago(query_frequency) .. now())
| where UrlCategory has_any (avoidance_categories)
| where not(DnsQuery in (_ExpectedBlockedDomainsComplete))
| where not(DnsQuery matches regex _ExpectedBlockedDomainsPartial)
| extend
HostName = tostring(Identities["AD Computers"]),
UserPrincipalName = tostring(Identities["AD Users"])
| summarize
StartTime = min(EventStartTime),
EndTime = max(EventStartTime),
EventCount = count(),
HostNames = make_set(HostName, 100),
UserPrincipalNames = make_set(UserPrincipalName, 100),
SrcIpAddrs = make_set(SrcIpAddr, 100),
SrcNatIpAddrs = make_set(SrcNatIpAddr, 100),
DnsQueryTypeNames = make_set(DnsQueryTypeName, 100),
take_any(EventResult, UrlCategory, ThreatCategory)
by EventResultDetails, DvcAction, DnsQuery, PolicyIdentityType, PolicyIdentity
| extend SLD = strcat_array(array_slice(split(DnsQuery, "."), -2, -1), ".")
| join kind=leftanti (
Cisco_Umbrella_dns_CL
| where TimeGenerated between (ago(query_period) .. ago(query_frequency))
| where Categories_s has_any (avoidance_categories)
| distinct Domain_s
| extend SLD = strcat_array(array_slice(split(Domain_s, "."), -3, -2), ".")
) on SLD
| project
StartTime,
EndTime,
EventCount,
HostNames,
UserPrincipalNames,
SrcIpAddrs,
SrcNatIpAddrs,
DnsQueryTypeNames,
DnsQuery,
SLD,
EventResult,
EventResultDetails,
DvcAction,
UrlCategory,
ThreatCategory,
PolicyIdentityType,
PolicyIdentity