First Time Source IP to Destination

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identifies the first time a source IP communicates with a destination based on a configurable learning period. Configurable Parameters: - Learning period time - learning period for threshold calculation in days. Default is set to 7.

Attribute	Value
Type	Hunting Query
Solution	Azure Firewall
ID	f055e82b-5ef6-4395-bc9e-99f7e451343a
Tactics	Exfiltration, CommandAndControl
Required Connectors	AzureFirewall
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
AZFWApplicationRule	✓	✗	?
AZFWNetworkRule	✓	✗	?
AzureDiagnostics 🔶	?	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Azure Firewall