Create Incident for XDR Alerts

Back


Id	0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd
Rulename	Create Incident for XDR Alerts
Description	This Query creates an incident based on Trend Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage.
Severity	High
Required data connectors	TrendMicroXDR
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Vision One/Analytic Rules/Create Incident for XDR Alerts.yaml
Version	1.0.4
Arm template	0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd.json

KQL

TrendMicro_XDR_WORKBENCH_CL
| extend Severity = case(severity_s == "low", "Informational",
                        severity_s == "medium", "Low",
                        severity_s == "high", "Medium",
                        "High"
                        )
| extend 
    UserAccountName_s = todynamic(column_ifexists("UserAccountName_s", "[]")),
    UserAccountNTDomain_s = todynamic(column_ifexists("UserAccountNTDomain_s", "[]")),
    FileName_s = todynamic(column_ifexists("FileName_s", "[]")),
    FileDirectory_s = todynamic(column_ifexists("FileDirectory_s", "[]")),
    ProcessCommandLine_s = todynamic(column_ifexists("ProcessCommandLine_s", "[]")),
    RegistryKey_s = todynamic(column_ifexists("RegistryKey_s", "[]")),
    RegistryValue_s = todynamic(column_ifexists("RegistryValue_s", "[]")),
    RegistryValueName_s = todynamic(column_ifexists("RegistryValueName_s", "[]"))

YAML

severity: High
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryPeriod: 5m
name: Create Incident for XDR Alerts
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Vision One/Analytic Rules/Create Incident for XDR Alerts.yaml
entityMappings:
- fieldMappings:
  - columnName: UserAccountName_s
    identifier: Name
  - columnName: UserAccountNTDomain_s
    identifier: NTDomain
  entityType: Account
- fieldMappings:
  - columnName: FileName_s
    identifier: Name
  - columnName: FileDirectory_s
    identifier: Directory
  entityType: File
- fieldMappings:
  - columnName: ProcessCommandLine_s
    identifier: CommandLine
  entityType: Process
- fieldMappings:
  - columnName: RegistryKey_s
    identifier: Key
  entityType: RegistryKey
- fieldMappings:
  - columnName: ProcessCommandLine_s
    identifier: Name
  - columnName: RegistryValue_s
    identifier: Value
  entityType: RegistryValue
alertDetailsOverride:
  alertDescriptionFormat: '{{description_s}}'
  alertDisplayNameFormat: '{{workbenchName_s}}'
  alertSeverityColumnName: Severity
version: 1.0.4
relevantTechniques: 
status: Available
suppressionEnabled: false
id: 0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd
queryFrequency: 5m
triggerThreshold: 0
triggerOperator: gt
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 5m
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
    groupByCustomDetails:
    - WorkbenchID
  createIncident: true
alertRuleTemplateName: 
query: |
  TrendMicro_XDR_WORKBENCH_CL
  | extend Severity = case(severity_s == "low", "Informational",
                          severity_s == "medium", "Low",
                          severity_s == "high", "Medium",
                          "High"
                          )
  | extend 
      UserAccountName_s = todynamic(column_ifexists("UserAccountName_s", "[]")),
      UserAccountNTDomain_s = todynamic(column_ifexists("UserAccountNTDomain_s", "[]")),
      FileName_s = todynamic(column_ifexists("FileName_s", "[]")),
      FileDirectory_s = todynamic(column_ifexists("FileDirectory_s", "[]")),
      ProcessCommandLine_s = todynamic(column_ifexists("ProcessCommandLine_s", "[]")),
      RegistryKey_s = todynamic(column_ifexists("RegistryKey_s", "[]")),
      RegistryValue_s = todynamic(column_ifexists("RegistryValue_s", "[]")),
      RegistryValueName_s = todynamic(column_ifexists("RegistryValueName_s", "[]"))  
suppressionDuration: 5h
customDetails:
  XDRCustomerID: xdrCustomerID_g
  Provider: alertProvider_s
  CreatedAt: createdTime_t
  WorkbenchLink: workbenchLink_s
  WorkbenchName: workbenchName_s
  ImpactScopeSummary: impactScope_Summary_s
  Severity: severity_s
  WorkbenchID: workbenchId_s
  PriorityScore: priorityScore_d
description: |
    'This Query creates an incident based on Trend Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage.'
requiredDataConnectors:
- connectorId: TrendMicroXDR
  dataTypes:
  - TrendMicro_XDR_WORKBENCH_CL
tactics: 
kind: Scheduled

ARM