TI map IP entity to Web Session Events (ASIM Web Session schema)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This rule identifies Web Sessions for which the source IP address is a known IoC. This rule uses the Advanced Security Information Model (ASIM) and supports any web session source that complies with ASIM.

Attribute	Value
Type	Analytic Rule
Solution	Threat Intelligence
ID	e2559891-383c-4caf-ae67-55a008b9f89e
Severity	Medium
Kind	Scheduled
Tactics	CommandAndControl
Techniques	T1071
Required Connectors	SquidProxy, Zscaler, ThreatIntelligence, ThreatIntelligenceTaxii, MicrosoftDefenderThreatIntelligence
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
ThreatIntelligenceIndicator	✓	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to Threat Intelligence