Skip to content

Commit 0c7c371

Browse files
vishallakhotiavishallakhotia
committed
added bot_bip.sql
1 parent b009291 commit 0c7c371

File tree

1 file changed

+128
-0
lines changed

1 file changed

+128
-0
lines changed

‎sql/bot_byip.sql

+128
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
-- This sql is categorizing all requests based on the labels attached such as relating to bots, amazon managed rules, types of requests
2+
SELECT
3+
httprequest.clientip,
4+
--baseline rule groups
5+
SUM(CASE WHEN label_items.name LIKE '%:core-rule-set:%' THEN 1 ELSE 0 END) is_core_rule_set, -- commonly occurring vulnerabilities described in OWASP publications such AS OWASP Top 10
6+
SUM(CASE WHEN label_items.name LIKE '%:admin-protection:%' THEN 1 ELSE 0 END) is_admin_protection,-- risk of a malicious actor gaining administrative access to your application
7+
SUM(CASE WHEN label_items.name LIKE '%:known-bad-inputs:%' THEN 1 ELSE 0 END) is_known_bad_inputs, -- risk of a malicious actor discovering a vulnerable application
8+
9+
--Use-case specific rule groups
10+
SUM(CASE WHEN label_items.name LIKE '%:sql-database:%' THEN 1 ELSE 0 END) is_sql_databASe, -- exploitation of SQL databASes, like SQL injection attacks
11+
SUM(CASE WHEN label_items.name LIKE '%:linux-os:%' THEN 1 ELSE 0 END) is_linux_os, -- exploitation of vulnerabilities specific to Linux, including Linux-specific Local File Inclusion (LFI) attacks
12+
SUM(CASE WHEN label_items.name LIKE '%:posix-os:%' THEN 1 ELSE 0 END) is_posix_os, --exploitation of vulnerabilities specific to POSIX and POSIX-like operating systems, including Local File Inclusion (LFI) attacks
13+
SUM(CASE WHEN label_items.name LIKE '%:windows-os:%' THEN 1 ELSE 0 END) is_windows_os, -- exploitation of vulnerabilities that permit an attacker to run unauthorized commands or run malicious code
14+
SUM(CASE WHEN label_items.name LIKE '%:php-app:%' THEN 1 ELSE 0 END) is_php_app, -- exploitation of vulnerabilities specific to the use of the PHP programming language, including injection of unsafe PHP functions
15+
SUM(CASE WHEN label_items.name LIKE '%:wordpress-app:%' THEN 1 ELSE 0 END) is_wordpress_app, -- exploitation of vulnerabilities specific to WordPress sites
16+
17+
-- IP reputation rule groups
18+
SUM(CASE WHEN label_items.name LIKE '%:amazon-ip-list:%' THEN 1 ELSE 0 END) is_amazon_ip_list, -- bASed on Amazon internal threat intelligence
19+
20+
-- Bot Control rule group
21+
SUM(CASE WHEN label_items.name LIKE '%:bot:verified%' THEN 1 ELSE 0 END) is_bot_verified,
22+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:%' THEN 1 ELSE 0 END) is_bot_common,
23+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:signal:automated_browser%' THEN 1 ELSE 0 END) is_automated_browser,
24+
SUM(CASE WHEN label_items.name LIKE '%:signal:known_bot_data_center%' THEN 1 ELSE 0 END) is_known_bot_data_center,
25+
SUM(CASE WHEN label_items.name LIKE '%:signal:non_browser_user_agent%' THEN 1 ELSE 0 END) is_non_browser_user_agent,
26+
SUM(CASE WHEN label_items.name LIKE '%:targeted:aggregate:volumetric:ip:token_absent%' THEN 1 ELSE 0 END) is_targeted_token_absent,
27+
SUM(CASE WHEN label_items.name LIKE '%:targeted:aggregate:volumetric:session:high%' THEN 1 ELSE 0 END) is_targeted_session_high,
28+
SUM(CASE WHEN label_items.name LIKE '%:targeted:signal:automated_browser%' THEN 1 ELSE 0 END) is_targeted_automated_browser,
29+
SUM(CASE WHEN label_items.name LIKE '%:targeted:signal:browser_inconsistency%' THEN 1 ELSE 0 END) is_targeted_browser_inconsistency,
30+
SUM(CASE WHEN label_items.name LIKE '%:targeted:aggregate:volumetric:session:token_reuse:ip%' THEN 1 ELSE 0 END) is_targeted_token_reuse_by_ips, -- Indicates the use of a single token among more than 5 distinct IP addresses
31+
SUM(CASE WHEN label_items.name LIKE '%:targeted:aggregate:coordinated_activity:low%' THEN 1 ELSE 0 END) is_coordinated_activity_low,
32+
SUM(CASE WHEN label_items.name LIKE '%:targeted:aggregate:coordinated_activity:medium%' THEN 1 ELSE 0 END) is_coordinated_activity_medium,
33+
SUM(CASE WHEN label_items.name LIKE '%:targeted:aggregate:coordinated_activity:high%' THEN 1 ELSE 0 END) is_coordinated_activity_high,
34+
-- ATP
35+
SUM(CASE WHEN label_items.name LIKE '%::managed:aws:atp:%' THEN 1 ELSE 0 END) is_atp,
36+
37+
-- ACFP
38+
SUM(CASE WHEN label_items.name LIKE '%::managed:aws:acfp:%' THEN 1 ELSE 0 END) is_acfp,
39+
40+
41+
-- OTHER RULES
42+
SUM(CASE WHEN action = 'CHALLENGE' THEN 1 END) AS challenge_requests,
43+
SUM(CASE WHEN action = 'BLOCK' THEN 1 END) AS BLOCK_requests,
44+
SUM(CASE WHEN action = 'ALLOW' THEN 1 END) AS ALLOW_requests,
45+
SUM(CASE WHEN action = 'CAPTCHA' THEN 1 END) AS CAPTCHA_requests,
46+
SUM(CASE WHEN label_items.name = 'awswaf:managed:token:accepted' THEN 1 ELSE 0 END) token_valid,
47+
SUM(CASE WHEN label_items.name = 'awswaf:managed:token:rejected' THEN 1 ELSE 0 END) token_rejected,
48+
SUM(CASE WHEN label_items.name = 'awswaf:managed:token:absent' THEN 1 ELSE 0 END) tokeN_absent,
49+
50+
51+
-- Static Assets
52+
SUM(CASE WHEN ELEMENT_AT(SPLIT(httprequest.uri, '.'), -1) IN ('css', 'js','ejs') THEN 1 ELSE 0 END) AS css_js_ejs,
53+
SUM(CASE WHEN ELEMENT_AT(SPLIT(httprequest.uri, '.'), -1) IN ('ico','svg','svgz','jpg','jpeg','gif','ico','png','bmp','pict','tif','tiff','webp','eps') THEN 1 ELSE 0 END) AS images,
54+
SUM(CASE WHEN ELEMENT_AT(SPLIT(httprequest.uri, '.'), -1) IN ( 'csv','doc','docx','xls','xlsx','pdf','pptx','ppt','txt','ps','json') THEN 1 ELSE 0 END) AS documents,
55+
SUM(CASE WHEN ELEMENT_AT(SPLIT(httprequest.uri, '.'), -1) IN ( 'cfm','xml','yaml','html','htm', 'php', 'min', 'aspx') THEN 1 ELSE 0 END) AS markup,
56+
SUM(CASE WHEN ELEMENT_AT(SPLIT(httprequest.uri, '.'), -1) IN ('ico') THEN 1 ELSE 0 END) AS ico,
57+
SUM(CASE WHEN ELEMENT_AT(SPLIT(httprequest.uri, '.'), -1) IN ('woff','woff2','ttf','otf','eot') THEN 1 ELSE 0 END) AS font,
58+
SUM(CASE WHEN ELEMENT_AT(SPLIT(httprequest.uri, '.'), -1) IN ('pls','swf','midi','mid','mp3','mp4','wav','wma') THEN 1 ELSE 0 END) AS media,
59+
SUM(CASE WHEN ELEMENT_AT(SPLIT(httprequest.uri, '.'), -1) IN ('jar','torrent','rar','zip','tar') THEN 1 ELSE 0 END) AS compressed_file,
60+
61+
-- Bot Categories
62+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:advertising%' THEN 1 ELSE 0 END) advertising,
63+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:archiver%' THEN 1 ELSE 0 END) archiver,
64+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:content_fetcher%' THEN 1 ELSE 0 END) content_fetcher,
65+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:email_client%' THEN 1 ELSE 0 END) email_client,
66+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:link_checker%' THEN 1 ELSE 0 END) link_checker,
67+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:miscellaneous%' THEN 1 ELSE 0 END) miscellaneous,
68+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:monitoring%' THEN 1 ELSE 0 END) monitoring,
69+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:scraping_framework%' THEN 1 ELSE 0 END) scraping_framework,
70+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:search_engine%' THEN 1 ELSE 0 END) search_engine,
71+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:security%' THEN 1 ELSE 0 END) security,
72+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:seo%' THEN 1 ELSE 0 END) seo,
73+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:social_media%' THEN 1 ELSE 0 END) social_media,
74+
SUM(CASE WHEN label_items.name LIKE '%:bot-control:bot:category:http_library%' THEN 1 ELSE 0 END) http_library,
75+
76+
77+
-- Other stats distinct Count
78+
SUM(CASE WHEN
79+
try(
80+
filter(
81+
httprequest.headers,
82+
x -> LOWER(x.name) = 'x-forwarded-for'
83+
)[1].value
84+
) is NULL then 0 ELSE 1 END ) AS header_x_forwarded_for_provided,
85+
COUNT(DISTINCT
86+
try(
87+
filter(
88+
httprequest.headers,
89+
x -> LOWER(x.name) = 'x-forwarded-for'
90+
)[1].value
91+
)) AS unique_header_x_forwarded_for,
92+
COUNT(DISTINCT try(
93+
filter(
94+
httprequest.headers,
95+
x -> LOWER(x.name) = 'accept-encoding'
96+
)[1].value
97+
)) AS unique_header_accept_encoding,
98+
COUNT(DISTINCT try(
99+
filter(
100+
httprequest.headers,
101+
x -> LOWER(x.name) = 'accept-language'
102+
)[1].value
103+
)) AS unique_header_accept_language,
104+
COUNT(DISTINCT httprequest.clientip) AS unique_client_ip,
105+
COUNT(DISTINCT try(
106+
filter(
107+
httprequest.headers,
108+
x -> LOWER(x.name) = 'user-agent'
109+
)[1].value)) AS unique_header_user_agent,
110+
COUNT(DISTINCT httprequest.uri) AS unique_uri,
111+
COUNT(DISTINCT try(
112+
filter(
113+
httprequest.headers,
114+
x -> LOWER(x.name) = 'host'
115+
)[1].value
116+
)) AS unique_header_host,
117+
count(DISTINCT(httprequest.requestid)) AS total_requests
118+
FROM waf_logs,
119+
120+
UNNEST( CASE WHEN cardinality(labels) >= 1
121+
THEN labels
122+
ELSE array[ cast( row('NOLABEL') as row(name varchar)) ]
123+
END
124+
) AS t(label_items)
125+
WHERE
126+
date >= date_format(current_date - interval '7' day, '%Y/%m/%d')
127+
GROUP BY httprequest.clientip
128+
ORDER BY httprequest.clientip

0 commit comments

Comments
 (0)