Vectra AI Detect - New Campaign Detected

Back


Id	a34d0338-eda0-42b5-8b93-32aae0d7a501
Rulename	Vectra AI Detect - New Campaign Detected
Description	Identifies when a new Campaign has been detected. This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.
Severity	Medium
Tactics	LateralMovement CommandAndControl
Required data connectors	AIVectraDetect AIVectraDetectAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml
Version	1.1.7
Arm template	a34d0338-eda0-42b5-8b93-32aae0d7a501.json

KQL

CommonSecurityLog
| where DeviceVendor == "Vectra Networks"
| where DeviceProduct == "X Series"
| where DeviceEventClassID contains "campaign"
| where DeviceAction == "START"
| extend reason = coalesce(
                          column_ifexists("Reason", ""), 
                          extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                          ""
                      )
| project-rename vectra_URL = DeviceCustomString4
| sort by TimeGenerated

YAML

severity: Medium
relevantTechniques: 
customDetails:
  CampaignReason: reason
  CampaignSourceHost: SourceHostName
  CampaignName: Activity
queryFrequency: 5m
kind: Scheduled
version: 1.1.7
name: Vectra AI Detect - New Campaign Detected
triggerOperator: gt
description: |
    'Identifies when a new Campaign has been detected.  This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: true
    enabled: true
    lookbackDuration: 7d
queryPeriod: 5m
query: |
  CommonSecurityLog
  | where DeviceVendor == "Vectra Networks"
  | where DeviceProduct == "X Series"
  | where DeviceEventClassID contains "campaign"
  | where DeviceAction == "START"
  | extend reason = coalesce(
                            column_ifexists("Reason", ""), 
                            extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                            ""
                        )
  | project-rename vectra_URL = DeviceCustomString4
  | sort by TimeGenerated  
alertDetailsOverride:
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: vectra_URL
  - alertProperty: ProductName
    value: DeviceProduct
  - alertProperty: ProviderName
    value: DeviceVendor
  alertDisplayNameFormat: Vectra AI - New Campaign Detected
  alertDescriptionFormat: |
        A new campaign named {{Activity}} has been detected (reason is {{reason}})
entityMappings:
- entityType: DNS
  fieldMappings:
  - columnName: Activity
    identifier: DomainName
tactics:
- LateralMovement
- CommandAndControl
status: Available
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml
id: a34d0338-eda0-42b5-8b93-32aae0d7a501
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: AIVectraDetect
- dataTypes:
  - CommonSecurityLog
  connectorId: AIVectraDetectAma

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a34d0338-eda0-42b5-8b93-32aae0d7a501')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a34d0338-eda0-42b5-8b93-32aae0d7a501')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A new campaign named {{Activity}} has been detected (reason is {{reason}})\n",
          "alertDisplayNameFormat": "Vectra AI - New Campaign Detected",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "vectra_URL"
            },
            {
              "alertProperty": "ProductName",
              "value": "DeviceProduct"
            },
            {
              "alertProperty": "ProviderName",
              "value": "DeviceVendor"
            }
          ]
        },
        "alertRuleTemplateName": "a34d0338-eda0-42b5-8b93-32aae0d7a501",
        "customDetails": {
          "CampaignName": "Activity",
          "CampaignReason": "reason",
          "CampaignSourceHost": "SourceHostName"
        },
        "description": "'Identifies when a new Campaign has been detected.  This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'\n",
        "displayName": "Vectra AI Detect - New Campaign Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "Activity",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "P7D",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": true
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Vectra Networks\"\n| where DeviceProduct == \"X Series\"\n| where DeviceEventClassID contains \"campaign\"\n| where DeviceAction == \"START\"\n| extend reason = coalesce(\n                          column_ifexists(\"Reason\", \"\"), \n                          extract(\"reason=(.+?)($|;)\", 1, AdditionalExtensions),\n                          \"\"\n                      )\n| project-rename vectra_URL = DeviceCustomString4\n| sort by TimeGenerated\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "LateralMovement"
        ],
        "techniques": null,
        "templateVersion": "1.1.7",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}