↳ GitHub sourceAnalytics ruleMedium

Excessive Amount of Denied Connections from a Single Source

Description

'This creates an incident in the event that a single source IP address generates a excessive amount of denied connections.'

Rule type: Scheduled
Version: 1.0.4
Declared status: Available
Query frequency: 1h
Query period: 1h
Trigger: gt 0

Declared MITRE coverage

Impact T1499

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

SyslogAma

KQL query

Original query, unchanged.

let threshold = 5000;
SophosXGFirewall
| where Log_Type =~ "Firewall" and Status =~ "Deny"
| summarize count() by Src_IP, bin(TimeGenerated,5m)
| where count_ > threshold

Declared entities

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Sophos XG Firewall/Analytic Rules/ExcessiveAmountofDeniedConnectionsfromASingleSource.yaml ↗
Commit: 9800e51 ↗
Source identifier: 3d645a88-2724-41a7-adea-db74c439cf79

Additional source files 2

Solutions/Sophos XG Firewall/Analytic Rules/ExcessiveAmountofDeniedConnectionsfromASingleSource.yamlsource ↗Solutions/Sophos XG Firewall/Data/Solution_SophosXGFirewall.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.