Azure Security Benchmark Posture Changed | Microsoft Sentinel Analytic Rules

Back


Id	0610e72f-ceaf-42d1-879e-952a1bd8d07a
Rulename	Azure Security Benchmark Posture Changed
Description	This rule monitors Azure policies aligned with the Azure Security Benchmark regulatory compliance initiative and triggers when policy compliance falls below 70% within a 7-day time window.
Severity	Medium
Tactics	Discovery
Techniques	T1082
Required data connectors	AzureSecurityCenter
Kind	Scheduled
Query frequency	7d
Query period	7d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureSecurityBenchmark/Analytic%20Rules/AzureSecurityBenchmarkPostureChanged.yaml
Version	1.0.2
Arm template	0610e72f-ceaf-42d1-879e-952a1bd8d07a.json

KQL

let ComplianceDomainLookup = SecurityRecommendation
| join kind=fullouter (SecurityRegulatoryCompliance | where ComplianceStandard == "Azure-Security-Benchmark") on RecommendationName
| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationName
| extend ComplianceDomain = iff(ComplianceControl contains "NS.", "Network Security", iff(ComplianceControl contains "IM.", "Identity Management", iff(ComplianceControl contains "PA.", "Privileged Access", iff(ComplianceControl contains "DP.", "Data Protection", iff(ComplianceControl contains "AM.", "Asset Management", iff(ComplianceControl contains "LT.", "Logging & Threat Detection", iff(ComplianceControl contains "IR.", "Incident Response", iff(ComplianceControl contains "PV.", "Posture & Vulnerability Management", iff(ComplianceControl contains "ES.", "Endpoint Security", iff(ComplianceControl contains "BR.", "Backup & Recovery", iff(ComplianceControl startswith "DS.", "DevOps Security", iff(ComplianceControl contains "GS.", "Governance & Strategy", "Other"))))))))))));
SecurityRecommendation
| join kind=fullouter (SecurityRegulatoryCompliance | where ComplianceStandard == "Azure-Security-Benchmark") on RecommendationName
| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationName
| extend ComplianceDomain = iff(ComplianceControl contains "NS.", "Network Security", iff(ComplianceControl contains "IM.", "Identity Management", iff(ComplianceControl contains "PA.", "Privileged Access", iff(ComplianceControl contains "DP.", "Data Protection", iff(ComplianceControl contains "AM.", "Asset Management", iff(ComplianceControl contains "LT.", "Logging & Threat Detection", iff(ComplianceControl contains "IR.", "Incident Response", iff(ComplianceControl contains "PV.", "Posture & Vulnerability Management", iff(ComplianceControl contains "ES.", "Endpoint Security", iff(ComplianceControl contains "BR.", "Backup & Recovery", iff(ComplianceControl startswith "DS.", "DevOps Security", iff(ComplianceControl contains "GS.", "Governance & Strategy", "Other"))))))))))))
| summarize Failed = countif(RecommendationState == "Unhealthy"), Passed = countif(RecommendationState == "Healthy"), Total = countif(RecommendationState == "Healthy" or RecommendationState == "Unhealthy") by ComplianceDomain
| extend PassedControlsPercentage = iff(Total > 0, (Passed / todouble(Total)) * 100.0, real(null))
| join kind=leftouter (ComplianceDomainLookup) on ComplianceDomain
| project ComplianceDomain, Total, PassedControlsPercentage, Passed, Failed, LastEvaluated = TimeGenerated
| summarize arg_max(LastEvaluated, *) by ComplianceDomain, Total, PassedControlsPercentage, Passed, Failed
| where PassedControlsPercentage < 70
| sort by PassedControlsPercentage asc, Passed desc
| extend RemediationLink = strcat("https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22")

YAML

triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureSecurityBenchmark/Analytic%20Rules/AzureSecurityBenchmarkPostureChanged.yaml
query: |
  let ComplianceDomainLookup = SecurityRecommendation
  | join kind=fullouter (SecurityRegulatoryCompliance | where ComplianceStandard == "Azure-Security-Benchmark") on RecommendationName
  | summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationName
  | extend ComplianceDomain = iff(ComplianceControl contains "NS.", "Network Security", iff(ComplianceControl contains "IM.", "Identity Management", iff(ComplianceControl contains "PA.", "Privileged Access", iff(ComplianceControl contains "DP.", "Data Protection", iff(ComplianceControl contains "AM.", "Asset Management", iff(ComplianceControl contains "LT.", "Logging & Threat Detection", iff(ComplianceControl contains "IR.", "Incident Response", iff(ComplianceControl contains "PV.", "Posture & Vulnerability Management", iff(ComplianceControl contains "ES.", "Endpoint Security", iff(ComplianceControl contains "BR.", "Backup & Recovery", iff(ComplianceControl startswith "DS.", "DevOps Security", iff(ComplianceControl contains "GS.", "Governance & Strategy", "Other"))))))))))));
  SecurityRecommendation
  | join kind=fullouter (SecurityRegulatoryCompliance | where ComplianceStandard == "Azure-Security-Benchmark") on RecommendationName
  | summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationName
  | extend ComplianceDomain = iff(ComplianceControl contains "NS.", "Network Security", iff(ComplianceControl contains "IM.", "Identity Management", iff(ComplianceControl contains "PA.", "Privileged Access", iff(ComplianceControl contains "DP.", "Data Protection", iff(ComplianceControl contains "AM.", "Asset Management", iff(ComplianceControl contains "LT.", "Logging & Threat Detection", iff(ComplianceControl contains "IR.", "Incident Response", iff(ComplianceControl contains "PV.", "Posture & Vulnerability Management", iff(ComplianceControl contains "ES.", "Endpoint Security", iff(ComplianceControl contains "BR.", "Backup & Recovery", iff(ComplianceControl startswith "DS.", "DevOps Security", iff(ComplianceControl contains "GS.", "Governance & Strategy", "Other"))))))))))))
  | summarize Failed = countif(RecommendationState == "Unhealthy"), Passed = countif(RecommendationState == "Healthy"), Total = countif(RecommendationState == "Healthy" or RecommendationState == "Unhealthy") by ComplianceDomain
  | extend PassedControlsPercentage = iff(Total > 0, (Passed / todouble(Total)) * 100.0, real(null))
  | join kind=leftouter (ComplianceDomainLookup) on ComplianceDomain
  | project ComplianceDomain, Total, PassedControlsPercentage, Passed, Failed, LastEvaluated = TimeGenerated
  | summarize arg_max(LastEvaluated, *) by ComplianceDomain, Total, PassedControlsPercentage, Passed, Failed
  | where PassedControlsPercentage < 70
  | sort by PassedControlsPercentage asc, Passed desc
  | extend RemediationLink = strcat("https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22")
requiredDataConnectors:
- dataTypes:
  - SecurityRecommendation
  - SecurityRegulatoryCompliance
  connectorId: AzureSecurityCenter
triggerThreshold: 0
severity: Medium
name: Azure Security Benchmark Posture Changed
alertDetailsOverride:
  alertDisplayNameFormat: Azure Security Benchmark posture below threshold for {{ComplianceDomain}}
id: 0610e72f-ceaf-42d1-879e-952a1bd8d07a
relevantTechniques:
- T1082
queryFrequency: 7d
customDetails:
  PassedControls: Passed
  FailedControls: Failed
  TotalControls: Total
  ComplianceDomain: ComplianceDomain
kind: Scheduled
queryPeriod: 7d
tactics:
- Discovery
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: RemediationLink
  entityType: URL
description: This rule monitors Azure policies aligned with the Azure Security Benchmark regulatory compliance initiative and triggers when policy compliance falls below 70% within a 7-day time window.
version: 1.0.2

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/0610e72f-ceaf-42d1-879e-952a1bd8d07a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/0610e72f-ceaf-42d1-879e-952a1bd8d07a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDisplayNameFormat": "Azure Security Benchmark posture below threshold for {{ComplianceDomain}}"
        },
        "alertRuleTemplateName": "0610e72f-ceaf-42d1-879e-952a1bd8d07a",
        "customDetails": {
          "ComplianceDomain": "ComplianceDomain",
          "FailedControls": "Failed",
          "PassedControls": "Passed",
          "TotalControls": "Total"
        },
        "description": "This rule monitors Azure policies aligned with the Azure Security Benchmark regulatory compliance initiative and triggers when policy compliance falls below 70% within a 7-day time window.",
        "displayName": "Azure Security Benchmark Posture Changed",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "RemediationLink",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AzureSecurityBenchmark/Analytic%20Rules/AzureSecurityBenchmarkPostureChanged.yaml",
        "query": "let ComplianceDomainLookup = SecurityRecommendation\n| join kind=fullouter (SecurityRegulatoryCompliance | where ComplianceStandard == \"Azure-Security-Benchmark\") on RecommendationName\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationName\n| extend ComplianceDomain = iff(ComplianceControl contains \"NS.\", \"Network Security\", iff(ComplianceControl contains \"IM.\", \"Identity Management\", iff(ComplianceControl contains \"PA.\", \"Privileged Access\", iff(ComplianceControl contains \"DP.\", \"Data Protection\", iff(ComplianceControl contains \"AM.\", \"Asset Management\", iff(ComplianceControl contains \"LT.\", \"Logging & Threat Detection\", iff(ComplianceControl contains \"IR.\", \"Incident Response\", iff(ComplianceControl contains \"PV.\", \"Posture & Vulnerability Management\", iff(ComplianceControl contains \"ES.\", \"Endpoint Security\", iff(ComplianceControl contains \"BR.\", \"Backup & Recovery\", iff(ComplianceControl startswith \"DS.\", \"DevOps Security\", iff(ComplianceControl contains \"GS.\", \"Governance & Strategy\", \"Other\"))))))))))));\nSecurityRecommendation\n| join kind=fullouter (SecurityRegulatoryCompliance | where ComplianceStandard == \"Azure-Security-Benchmark\") on RecommendationName\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationName\n| extend ComplianceDomain = iff(ComplianceControl contains \"NS.\", \"Network Security\", iff(ComplianceControl contains \"IM.\", \"Identity Management\", iff(ComplianceControl contains \"PA.\", \"Privileged Access\", iff(ComplianceControl contains \"DP.\", \"Data Protection\", iff(ComplianceControl contains \"AM.\", \"Asset Management\", iff(ComplianceControl contains \"LT.\", \"Logging & Threat Detection\", iff(ComplianceControl contains \"IR.\", \"Incident Response\", iff(ComplianceControl contains \"PV.\", \"Posture & Vulnerability Management\", iff(ComplianceControl contains \"ES.\", \"Endpoint Security\", iff(ComplianceControl contains \"BR.\", \"Backup & Recovery\", iff(ComplianceControl startswith \"DS.\", \"DevOps Security\", iff(ComplianceControl contains \"GS.\", \"Governance & Strategy\", \"Other\"))))))))))))\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Healthy\" or RecommendationState == \"Unhealthy\") by ComplianceDomain\n| extend PassedControlsPercentage = iff(Total > 0, (Passed / todouble(Total)) * 100.0, real(null))\n| join kind=leftouter (ComplianceDomainLookup) on ComplianceDomain\n| project ComplianceDomain, Total, PassedControlsPercentage, Passed, Failed, LastEvaluated = TimeGenerated\n| summarize arg_max(LastEvaluated, *) by ComplianceDomain, Total, PassedControlsPercentage, Passed, Failed\n| where PassedControlsPercentage < 70\n| sort by PassedControlsPercentage asc, Passed desc\n| extend RemediationLink = strcat(\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22\")\n",
        "queryFrequency": "P7D",
        "queryPeriod": "P7D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery"
        ],
        "techniques": [
          "T1082"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}