Cortex causality view of WebDialer SSRF to internal resources
This rule detects Server-Side Request Forgery (SSRF) attempts originating from Cisco WebDialer by identifying network requests targeting loopback addresses (127.0.0.1, localhost, ::1), cloud instance metadata API addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or using 'file://' or 'gopher://' protocols. The rule specifically looks for 'webdialer' in the event_sub_type or action_remote_ip fields to narrow down the source of the request. The XQL view includes actor and causality fields for further investigation.
Cortex XDR
