↳ GitHub sourceAnalytics ruleMedium

SonicWall - Allowed SSH, Telnet, and RDP Connections

Description

'This rule identifies allowed inbound SSH, Telnet, and RDP connections. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewall).'

Rule type: Scheduled
Version: 1.0.1
Declared status: Experimental
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CEF SonicWallFirewall CefAma

Data types

CommonSecurityLog ASimNetworkSessionSonicWallFirewall

KQL query

Original query, unchanged.

ASimNetworkSessionSonicWallFirewall(false)
| where NetworkDirection == "Inbound" and EventResult in ("NA", "Success")
| where EventOriginalType != 1370
| where SrcAppName contains "Windows Remote Desktop Services"
    or SrcAppName contains "Telnet"
    or (SrcAppName contains "SSH Protocol" and ThreatId != 446) // Filters out SSH server responses.
    or SrcAppName contains "Bitvise SSH"
    or DstPortNumber in (22, 23, 3389)

Declared entities

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/SonicWall Firewall/Analytic Rules/AllowedInboundSSHTelnetRDPConnections.yaml ↗
Commit: 9800e51 ↗
Source identifier: 27f1a570-5f20-496b-88f6-a9aa2c5c9534

Additional source files 2

Solutions/SonicWall Firewall/Analytic Rules/AllowedInboundSSHTelnetRDPConnections.yamlsource ↗Solutions/SonicWall Firewall/Data/Solution_SonicWall Firewall.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.