↳ GitHub sourceAnalytics ruleMedium

Contrast ADR - WAF Alert Correlation

Description

'Correlates Contrast ADR security alerts with WAF logs to identify confirmed attack attempts that were either exploited or blocked. This rule helps security teams prioritize incidents by focusing on attacks that have been validated by application security monitoring.'

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

ContrastADRCCF

Data types

ContrastADRAttackEvents_CL

KQL query

Original query, unchanged.

ContrastADRAttackEvents_CL
| where result =~ "exploited" or result =~ "blocked"
| project-rename ip=sourceIp
//please add you WAF table in place of ContrastWAFLogs_CL and WAF tables source IP or target IP column's inplace of ip and uncomment the queries below
//| join kind=inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on ip

Declared entities

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/ContrastADR/Analytic Rules/Contrast_ADR_Confirmed_WAF.yaml ↗
Commit: 9800e51 ↗
Source identifier: 93641436-afb3-4921-8828-ceab0d15aaab

Additional source files 2

Solutions/ContrastADR/Analytic Rules/Contrast_ADR_Confirmed_WAF.yamlsource ↗Solutions/ContrastADR/Data/Solution_ContrastADR.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.