Classification:

attack

Tactic:

TA0011-command-and-control

Technique:

T1071-application-layer-protocol

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects a high frequency of blocked web requests, which may indicate potential security incidents, such as unauthorized access attempts, reconnaissance activities, or misconfigured systems generating anomalous traffic.

Strategy

This rule monitors blocked web requests across users and raises an alert if the count exceeds the threshold, which may signify suspicious activity or operational anomalies that require investigation.

Triage and Response

1. Identify the user {{@usr.name}} associated with the blocked requests.
2. Check for patterns like repeated login failures, unusual request volumes, or connections from suspicious IPs.
3. Investigate recent policy changes or misconfigurations that might explain the activity.
4. If malicious behavior is detected, block offending IPs, restrict access, and review account and access controls.