Create Incident for XDR Alerts | Microsoft Sentinel Analytic Rules

Back


Id	0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd
Rulename	Create Incident for XDR Alerts
Description	This Query creates an incident based on Trend Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage.
Severity	High
Required data connectors	TrendMicroXDR
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend%20Micro%20Vision%20One/Analytic%20Rules/Create%20Incident%20for%20XDR%20Alerts.yaml
Version	1.0.4
Arm template	0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd.json

KQL

TrendMicro_XDR_WORKBENCH_CL
| extend Severity = case(severity_s == "low", "Informational",
                        severity_s == "medium", "Low",
                        severity_s == "high", "Medium",
                        "High"
                        )
| extend 
    UserAccountName_s = todynamic(column_ifexists("UserAccountName_s", "[]")),
    UserAccountNTDomain_s = todynamic(column_ifexists("UserAccountNTDomain_s", "[]")),
    FileName_s = todynamic(column_ifexists("FileName_s", "[]")),
    FileDirectory_s = todynamic(column_ifexists("FileDirectory_s", "[]")),
    ProcessCommandLine_s = todynamic(column_ifexists("ProcessCommandLine_s", "[]")),
    RegistryKey_s = todynamic(column_ifexists("RegistryKey_s", "[]")),
    RegistryValue_s = todynamic(column_ifexists("RegistryValue_s", "[]")),
    RegistryValueName_s = todynamic(column_ifexists("RegistryValueName_s", "[]"))

YAML

status: Available
queryPeriod: 5m
version: 1.0.4
severity: High
customDetails:
  Severity: severity_s
  WorkbenchID: workbenchId_s
  WorkbenchName: workbenchName_s
  ImpactScopeSummary: impactScope_Summary_s
  PriorityScore: priorityScore_d
  CreatedAt: createdTime_t
  XDRCustomerID: xdrCustomerID_g
  Provider: alertProvider_s
  WorkbenchLink: workbenchLink_s
relevantTechniques: 
kind: Scheduled
alertDetailsOverride:
  alertSeverityColumnName: Severity
  alertDisplayNameFormat: '{{workbenchName_s}}'
  alertDescriptionFormat: '{{description_s}}'
queryFrequency: 5m
id: 0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd
description: |
  'This Query creates an incident based on Trend Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage.'
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByCustomDetails:
    - WorkbenchID
    matchingMethod: Selected
    reopenClosedIncident: false
    enabled: true
    lookbackDuration: 5m
query: |
  TrendMicro_XDR_WORKBENCH_CL
  | extend Severity = case(severity_s == "low", "Informational",
                          severity_s == "medium", "Low",
                          severity_s == "high", "Medium",
                          "High"
                          )
  | extend 
      UserAccountName_s = todynamic(column_ifexists("UserAccountName_s", "[]")),
      UserAccountNTDomain_s = todynamic(column_ifexists("UserAccountNTDomain_s", "[]")),
      FileName_s = todynamic(column_ifexists("FileName_s", "[]")),
      FileDirectory_s = todynamic(column_ifexists("FileDirectory_s", "[]")),
      ProcessCommandLine_s = todynamic(column_ifexists("ProcessCommandLine_s", "[]")),
      RegistryKey_s = todynamic(column_ifexists("RegistryKey_s", "[]")),
      RegistryValue_s = todynamic(column_ifexists("RegistryValue_s", "[]")),
      RegistryValueName_s = todynamic(column_ifexists("RegistryValueName_s", "[]"))
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: UserAccountName_s
  - identifier: NTDomain
    columnName: UserAccountNTDomain_s
- entityType: File
  fieldMappings:
  - identifier: Name
    columnName: FileName_s
  - identifier: Directory
    columnName: FileDirectory_s
- entityType: Process
  fieldMappings:
  - identifier: CommandLine
    columnName: ProcessCommandLine_s
- entityType: RegistryKey
  fieldMappings:
  - identifier: Key
    columnName: RegistryKey_s
- entityType: RegistryValue
  fieldMappings:
  - identifier: Name
    columnName: ProcessCommandLine_s
  - identifier: Value
    columnName: RegistryValue_s
triggerThreshold: 0
suppressionEnabled: false
tactics: 
suppressionDuration: 5h
alertRuleTemplateName: 
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend%20Micro%20Vision%20One/Analytic%20Rules/Create%20Incident%20for%20XDR%20Alerts.yaml
requiredDataConnectors:
- dataTypes:
  - TrendMicro_XDR_WORKBENCH_CL
  connectorId: TrendMicroXDR
name: Create Incident for XDR Alerts

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{description_s}}",
          "alertDisplayNameFormat": "{{workbenchName_s}}",
          "alertSeverityColumnName": "Severity"
        },
        "alertRuleTemplateName": "0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd",
        "customDetails": {
          "CreatedAt": "createdTime_t",
          "ImpactScopeSummary": "impactScope_Summary_s",
          "PriorityScore": "priorityScore_d",
          "Provider": "alertProvider_s",
          "Severity": "severity_s",
          "WorkbenchID": "workbenchId_s",
          "WorkbenchLink": "workbenchLink_s",
          "WorkbenchName": "workbenchName_s",
          "XDRCustomerID": "xdrCustomerID_g"
        },
        "description": "'This Query creates an incident based on Trend Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage.'\n",
        "displayName": "Create Incident for XDR Alerts",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserAccountName_s",
                "identifier": "Name"
              },
              {
                "columnName": "UserAccountNTDomain_s",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "File",
            "fieldMappings": [
              {
                "columnName": "FileName_s",
                "identifier": "Name"
              },
              {
                "columnName": "FileDirectory_s",
                "identifier": "Directory"
              }
            ]
          },
          {
            "entityType": "Process",
            "fieldMappings": [
              {
                "columnName": "ProcessCommandLine_s",
                "identifier": "CommandLine"
              }
            ]
          },
          {
            "entityType": "RegistryKey",
            "fieldMappings": [
              {
                "columnName": "RegistryKey_s",
                "identifier": "Key"
              }
            ]
          },
          {
            "entityType": "RegistryValue",
            "fieldMappings": [
              {
                "columnName": "ProcessCommandLine_s",
                "identifier": "Name"
              },
              {
                "columnName": "RegistryValue_s",
                "identifier": "Value"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "WorkbenchID"
            ],
            "lookbackDuration": "PT5M",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend%20Micro%20Vision%20One/Analytic%20Rules/Create%20Incident%20for%20XDR%20Alerts.yaml",
        "query": "TrendMicro_XDR_WORKBENCH_CL\n| extend Severity = case(severity_s == \"low\", \"Informational\",\n                        severity_s == \"medium\", \"Low\",\n                        severity_s == \"high\", \"Medium\",\n                        \"High\"\n                        )\n| extend \n    UserAccountName_s = todynamic(column_ifexists(\"UserAccountName_s\", \"[]\")),\n    UserAccountNTDomain_s = todynamic(column_ifexists(\"UserAccountNTDomain_s\", \"[]\")),\n    FileName_s = todynamic(column_ifexists(\"FileName_s\", \"[]\")),\n    FileDirectory_s = todynamic(column_ifexists(\"FileDirectory_s\", \"[]\")),\n    ProcessCommandLine_s = todynamic(column_ifexists(\"ProcessCommandLine_s\", \"[]\")),\n    RegistryKey_s = todynamic(column_ifexists(\"RegistryKey_s\", \"[]\")),\n    RegistryValue_s = todynamic(column_ifexists(\"RegistryValue_s\", \"[]\")),\n    RegistryValueName_s = todynamic(column_ifexists(\"RegistryValueName_s\", \"[]\"))\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": null,
        "techniques": null,
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}