↳ GitHub sourceAnalytics ruleMedium

Cisco Umbrella - Request Allowed to harmful/malicious URI category

View on GitHub ↗Original file ↗

An inconsistency was detected in the sources: variants or an invalid file. Check the files and commit shown below.

Description

'It is reccomended that these Categories shoud be blocked by policies because they provide harmful/malicious content..'

Rule type: Scheduled
Version: 1.1.1
Query frequency: 10m
Query period: 10m
Trigger: gt 0

Declared MITRE coverage

CommandAndControl InitialAccess

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CiscoUmbrellaDataConnector

Data types

Cisco_Umbrella_proxy_CL

KQL query

Original query, unchanged.

let lbtime = 10m;
Cisco_Umbrella
| where TimeGenerated > ago(lbtime)
| where EventType == 'proxylogs'
| where DvcAction =~ 'Allowed'
| where UrlCategory contains 'Adult Themes' or
      UrlCategory contains 'Adware' or
      UrlCategory contains 'Alcohol' or
      UrlCategory contains 'Illegal Downloads' or
      UrlCategory contains 'Drugs' or
      UrlCategory contains 'Child Abuse Content' or
      UrlCategory contains 'Hate/Discrimination' or
      UrlCategory contains 'Nudity' or
      UrlCategory contains 'Pornography' or
      UrlCategory contains 'Proxy/Anonymizer' or
      UrlCategory contains 'Sexuality' or
      UrlCategory contains 'Tasteless' or
      UrlCategory contains 'Terrorism' or
      UrlCategory contains 'Web Spam' or
      UrlCategory contains 'German Youth Protection' or
      UrlCategory contains 'Illegal Activities' or
      UrlCategory contains 'Lingerie/Bikini' or
      UrlCategory contains 'Weapons'
| project TimeGenerated, SrcIpAddr, Identities

Declared entities

AccountIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Detections/CiscoUmbrella/CiscoUmbrellaRequestAllowedHarmfulMaliciousURICategory.yaml ↗
Commit: 9800e51 ↗
Source identifier: d6bf1931-b1eb-448d-90b2-de118559c7ce

Additional source files 1

Detections/CiscoUmbrella/CiscoUmbrellaRequestAllowedHarmfulMaliciousURICategory.yamlsource ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.