List Malicious Network Traffic Detected From LAN To WAN By Fortinet
Description
This KQL query looks for malicious network traffic detected by Fortinet from LAN to WAN.
Risk
Explain what risk this detection tries to cover.
Query
Microsoft Sentinel
Kusto
CommonSecurityLog
| where DeviceVendor == "Fortinet"
| where isnotempty(IndicatorThreatType)
| where isempty(DestinationHostName)
| where isnotempty(DeviceOutboundInterface)
| where DeviceAction != "deny" and DeviceAction != "close" and DeviceAction != "blocked" and isnotempty(DeviceAction)
| mv-expand todynamic(IndicatorThreatType)
| where ReportReferenceLink has "?tags="
| extend ReportReferenceLink=split(ReportReferenceLink,"=",1)
| mv-expand ReportReferenceLink to typeof(string)
| extend MalwareType=split(ReportReferenceLink, "&")
| mv-expand MalwareType to typeof(string)
| where MalwareType <> "languageCode"
| extend identified_application = split(AdditionalExtensions, ";")
| project TimeGenerated, IndicatorThreatType, ApplicationProtocol, SourceIP, SourcePort, Message, identified_application[23], identified_application[21], DeviceOutboundInterface, ThreatConfidence, MalwareType, MaliciousIPCountry, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated