Sunturai
Back to results
MediumMicrosoft Sentinel analytics

Contrast ADR - WAF Alert Correlation

Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have…

Description

Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesSaaSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Log source product
contrastadrccf
Log source service
contrastadrattackevents_cl

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice