defensive-ssrf

To detect SSRF exploitation attempts against cloud metadata endpoints, you can apply Sigma rules for SSRF payloads and query KQL telemetry for Azure and MDE to monitor web apps, APIs, and CI/CD pipelines for malicious internal network calls.

The best way to harden Azure deployments against server-side request forgery is to enforce IMDSv2 for cloud metadata checks and apply strict egress controls to prevent unauthorized internal network calls from web applications.

Yes, you can use KQL to monitor for SSRF indicators in MDE telemetry. This skill integrates KQL queries to identify server-side request forgery attempts across Azure workloads and internal IP addresses.

Yes, this detection workflow supports Sigma rules for SSRF payloads. It leverages Sigma-based detection logic to identify server-side request forgery attempts within SOC operations and cloud security workflows.

To start monitoring web apps for IMDS-based SSRF risks, run the SSRF detection workflow against your cloud workloads. This process identifies internal IP and metadata endpoint exploitation indicators across your environment.