Skip to content

Added 5 new detections for Azure Firewall Sentinel Solution#13591

Open
shabaz-github wants to merge 10 commits intoAzure:masterfrom
shabaz-github:master
Open

Added 5 new detections for Azure Firewall Sentinel Solution#13591
shabaz-github wants to merge 10 commits intoAzure:masterfrom
shabaz-github:master

Conversation

@shabaz-github
Copy link
Contributor

Required items, please complete

Change(s):

  • Added the following 5 new detections for Azure Firewall Sentinel Solution.
  • High severity malicious activity detected
  • Medium severity malicious activity detected
  • Web Application attack detected
  • DDoS attack detected
  • Elevation of Privilege attempt detected

Reason for Change(s):

  • To add new built-in detections for Azure Firewall Sentinel Solution

Version Updated:

  • Yes

Testing Completed:

  • Yes

Checked that the validations are passing and have addressed any issues that are present:

  • Yes

Added analytic rule for detecting high severity malicious activity in Azure Firewall IDPS logs.
Updated the analytic rule to identify medium severity malicious activity in Azure Firewall IDPS logs. Adjusted parameters such as time window, hit threshold, and categories of interest.
This analytic rule identifies web application attacks in Azure Firewall IDPS logs, with a focus on high severity incidents.
This analytic rule identifies DDoS attacks in Azure Firewall IDPS logs, providing details on severity, actions, and threat categories.
Updated the analytic rule to detect Elevation of Privilege attempts instead of DDoS attacks. Adjusted relevant fields and filters accordingly.
Increased the time window for DDoS attack detection from 30 days to 90 days.
@shabaz-github shabaz-github requested review from a team as code owners February 6, 2026 15:35
@v-maheshbh v-maheshbh added the Solution Solution specialty review needed label Feb 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Solution Solution specialty review needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants