↳ GitHub sourceAnalytics ruleMedium

SonicWall - Capture ATP Malicious File Detection

Description

'This rule identifies malicious file verdicts from the SonicWall Capture ATP service. This analytic rule leverages the SonicWall Firewall ASIM Network Session parser (ASimNetworkSessionSonicWallFirewall). Ref: https://www.sonicwall.com/products/capture-advanced-threat-protection/ Ref: https://www.sonicwall.com/support/knowledge-base/how-to-view-threat-reports-capture-atp/170505384715913/'

Rule type: Scheduled
Version: 1.0.2
Declared status: Experimental
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared MITRE coverage

Execution T1204

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CefAma

Data types

CommonSecurityLog

KQL query

Original query, unchanged.

CommonSecurityLog
| where DeviceEventClassID == 1631
| extend CaptureATPVerdict = extract(@'Gateway Anti-Virus Status: (.*)\. ', 1, Message)
| where CaptureATPVerdict == "BAD"
| parse-kv AdditionalExtensions as (['susr']:string, ['fileid']:string) with (pair_delimiter=";", kv_delimiter="=")
| extend
    NetworkProtocol = toupper(iff(Protocol contains "-" and Protocol !contains "/", toupper(trim_start(@".*-", Protocol)), toupper(trim_end(@"/.*", Protocol)))),
    NetworkApplicationProtocol = tostring(toupper(trim_start(@".*/", Protocol)))
| project
    TimeGenerated,
    DeviceModel = DeviceProduct,
    SerialNumber = Computer,
    SrcIpAddr = SourceIP,
    SrcUsername = coalesce(susr, SourceUserName),
    NetworkProtocol,
    NetworkApplicationProtocol,
    RequestURL,
    File = url_decode(tostring(split(RequestURL, '/')[-1])),
    Hash = fileid,
    Verdict = CaptureATPVerdict

Declared entities

FileUrlAccountIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/SonicWall Firewall/Analytic Rules/CaptureATPMaliciousFileDetection.yaml ↗
Commit: 9800e51 ↗
Source identifier: 3db9f99e-a459-41e0-8e02-8b332f5fcb2c

Additional source files 2

Solutions/SonicWall Firewall/Analytic Rules/CaptureATPMaliciousFileDetection.yamlsource ↗Solutions/SonicWall Firewall/Data/Solution_SonicWall Firewall.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.