Sunturai
Back to results
MediumMicrosoft Sentinel analytics

Excessive number of failed connections from a single source (ASIM Network Session schema)

This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive is the rule and…

Description

This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive is the rule and less incidents will be generated. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema

Detection logic

Detection requirements

Platform
ContainersIaaSLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
aivectrastreamawss3azurefirewallazuremonitor_vminsightsazurensgcheckpointciscoasaciscoasaamaciscomerakicorelightfortinetmicrosoftsysmonforlinuxmicrosoftthreatprotectionpaloaltonetworkssecurityeventswindowsforwardedeventswindowssecurityeventszscaler
Log source service
awsvpcflowazurediagnosticsciscomerakinativepollercommonsecuritylogcorelight_cldevicenetworkeventssecurityeventsyslogvectrastreamvmconnectionwindowsevent

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice