Azure Sentinel - IIS brute force tracking

Question

Hello,

I want to create KQL query that catches brute force attacks against IIS server.

A this time i have information about successful logins and failed attempts. I want to track information about failed and successful login to IIS server, host, IP, login count etc.

For example - if there was 50 failed sign-in times generate alert and create incident. Or something like this.

Is there some IIS KQL samples?

Answer 1

@Eduards Give this a try : https://github.com/Azure/Azure-Sentinel/blob/master/Hunting%20Queries/W3CIISLog/Potential_IIS_BF.yaml