Registries Alerts for Prancer

Back


Id	08706063-c15e-4d96-beae-9e8d92ccefbb
Rulename	Registries Alerts for Prancer
Description	High severity registry alerts found by Prancer.
Severity	High
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	PrancerLogData
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Registries_High_Severity.yaml
Version	1.0.2
Arm template	08706063-c15e-4d96-beae-9e8d92ccefbb.json

KQL

union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.ContainerRegistry/registries'
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot 
| extend
    id = tostring(snapshot.id),
    structure = tostring(snapshot.structure),
    reference = tostring(snapshot.reference),
    source = tostring(snapshot.source),
    collection = tostring(snapshot.collection),
    type = tostring(snapshot.type),
    region = tostring(snapshot.region),
    resourceTypes = tostring(snapshot.resourceTypes),
    path = tostring(snapshot.path)

YAML

alertDetailsOverride:
  alertDynamicProperties:
  - alertProperty: RemediationSteps
    value: data_data_remediation_description_s
  alertDescriptionFormat: '{{data_data_description_s}}'
  alertSeverityColumnName: '{{data_data_severity_s}}'
  alertDisplayNameFormat: '{{data_data_message_s}}'
description: |
    'High severity registry alerts found by Prancer.'
kind: Scheduled
tactics:
- Reconnaissance
requiredDataConnectors:
- connectorId: PrancerLogData
  dataTypes:
  - prancer_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Registries_High_Severity.yaml
severity: High
name: Registries Alerts for Prancer
customDetails: 
triggerThreshold: 0
queryPeriod: 5h
query: |
  union prancer_CL
  | where deviceProduct_s == 'azure'
  | where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.ContainerRegistry/registries'
  | where data_data_severity_s == 'High' and data_data_result_s == 'failed'
  | extend snapshot = parse_json(data_data_snapshots_s)
  | mv-expand snapshot 
  | extend
      id = tostring(snapshot.id),
      structure = tostring(snapshot.structure),
      reference = tostring(snapshot.reference),
      source = tostring(snapshot.source),
      collection = tostring(snapshot.collection),
      type = tostring(snapshot.type),
      region = tostring(snapshot.region),
      resourceTypes = tostring(snapshot.resourceTypes),
      path = tostring(snapshot.path)  
relevantTechniques:
- T1595
id: 08706063-c15e-4d96-beae-9e8d92ccefbb
queryFrequency: 5h
status: Available
version: 1.0.2
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: AzureResource
  fieldMappings:
  - columnName: path
    identifier: ResourceId

ARM