AI SOC Daily Security Report

Zero Trust → Access → Applications
  - Application: dev.tek-safari.com
  - Application: beta.tek-safari.com
  - Application: internal.tek-safari.com
  Policy:
    Action:  Allow
    Include: emails ending in @yourcompany.com
    Require: WebAuthn or TOTP
    Session: 4h
# Outcome: 開発・ステージング環境は社内ユーザーのみアクセス可

(http.host in {"dev.tek-safari.com"
               "beta.tek-safari.com"
               "internal.tek-safari.com"
               "en.tek-safari.com"
               "cpcontacts.tek-safari.com"}
 and not ip.src in {OFFICE_IPS})

{
  "action": "block",
  "description": "SOC-RULE-001b Temporary block of non-production subdomains until Access is deployed",
  "enabled": true,
  "expression": "(http.host in {\"dev.tek-safari.com\" \"beta.tek-safari.com\" \"internal.tek-safari.com\" \"en.tek-safari.com\" \"cpcontacts.tek-safari.com\"} and not ip.src in {OFFICE_IPS})"
}

(starts_with(http.user_agent, "Go-http-client/")
 and not http.request.uri.path matches "^/(api/webhook|metrics)/"
 and (starts_with(http.request.uri.path, "/wp-")
      or http.request.uri.path eq "/xmlrpc.php"
      or http.request.uri.path matches "\\.php$"))

{
  "action": "managed_challenge",
  "description": "SOC-RULE-002 Challenge Go-http-client UA on WordPress/PHP paths",
  "enabled": true,
  "expression": "(starts_with(http.user_agent, \"Go-http-client/\") and not http.request.uri.path matches \"^/(api/webhook|metrics)/\" and (starts_with(http.request.uri.path, \"/wp-\") or http.request.uri.path eq \"/xmlrpc.php\" or http.request.uri.path matches \"\\\\.php$\"))"
}

(ip.src.asnum in {8075 14618 16509 396982 16276 24940 63949 14061 20473}
 and (starts_with(http.request.uri.path, "/wp-")
      or http.request.uri.path eq "/xmlrpc.php"
      or http.request.uri.path matches "\\.php$"))

(http.request.uri.query matches "(?i)(\\.\\./|\\.\\.\\\\|/etc/passwd|/proc/self|wp-config\\.php|php://filter|php://input|file://|expect://)"
 or lower(http.request.uri.path) matches "(\\.\\./|\\.\\.\\\\)")

既存ルール継続。POST制限 3req/min/IP・GETはManaged Challenge化を継続。

(lower(http.request.uri.path) matches "^/(about|inputs|as|adminfuns|sf|goods|info|ioxi-o|themes|admin|abc|cache|file|404|classwithtostring|chosen|config|style)\\.php$"
 or lower(http.request.uri.path) matches "^/index/function\\.php$"
 or lower(http.request.uri.path) matches "(alfa_data|alfacgiapi|\\.alfa)")