Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Create Incident for XDR Alerts

Back
Id0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd
RulenameCreate Incident for XDR Alerts
DescriptionThis Query creates an incident based on Trend Micro Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage.
SeverityHigh
Required data connectorsTrendMicroXDR
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Vision One/Analytic Rules/Create Incident for XDR Alerts.yaml
Version1.0.2
Arm template0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd.json
Deploy To Azure
TrendMicro_XDR_WORKBENCH_CL
| extend Severity = case(severity_s == "low", "Informational",
                        severity_s == "medium", "Low",
                        severity_s == "high", "Medium",
                        "High"
                        )
| extend 
    UserAccountName_s = todynamic(UserAccountName_s)[0],
    UserAccountNTDomain_s = todynamic(UserAccountNTDomain_s)[0],
    FileName_s = todynamic(FileName_s)[0],
    FileDirectory_s = todynamic(FileDirectory_s)[0],
    ProcessCommandLine_s = todynamic(ProcessCommandLine_s)[0],
    RegistryKey_s = todynamic(RegistryKey_s)[0],
    RegistryValue_s = todynamic(RegistryValue_s)[0],
    RegistryValueName_s = todynamic(RegistryValueName_s)[0]
queryFrequency: 5m
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: UserAccountName_s
    identifier: Name
  - columnName: UserAccountNTDomain_s
    identifier: NTDomain
- entityType: File
  fieldMappings:
  - columnName: FileName_s
    identifier: Name
  - columnName: FileDirectory_s
    identifier: Directory
- entityType: Process
  fieldMappings:
  - columnName: ProcessCommandLine_s
    identifier: CommandLine
- entityType: RegistryKey
  fieldMappings:
  - columnName: RegistryKey_s
    identifier: Key
- entityType: RegistryValue
  fieldMappings:
  - columnName: ProcessCommandLine_s
    identifier: Name
  - columnName: RegistryValue_s
    identifier: Value
severity: High
triggerThreshold: 0
suppressionEnabled: false
suppressionDuration: 5h
relevantTechniques: 
query: |
  TrendMicro_XDR_WORKBENCH_CL
  | extend Severity = case(severity_s == "low", "Informational",
                          severity_s == "medium", "Low",
                          severity_s == "high", "Medium",
                          "High"
                          )
  | extend 
      UserAccountName_s = todynamic(UserAccountName_s)[0],
      UserAccountNTDomain_s = todynamic(UserAccountNTDomain_s)[0],
      FileName_s = todynamic(FileName_s)[0],
      FileDirectory_s = todynamic(FileDirectory_s)[0],
      ProcessCommandLine_s = todynamic(ProcessCommandLine_s)[0],
      RegistryKey_s = todynamic(RegistryKey_s)[0],
      RegistryValue_s = todynamic(RegistryValue_s)[0],
      RegistryValueName_s = todynamic(RegistryValueName_s)[0]  
id: 0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd
triggerOperator: gt
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByAlertDetails: []
    groupByEntities: []
    reopenClosedIncident: false
    enabled: true
    lookbackDuration: 5m
    matchingMethod: Selected
    groupByCustomDetails:
    - WorkbenchID
requiredDataConnectors:
- connectorId: TrendMicroXDR
  dataTypes:
  - TrendMicro_XDR_WORKBENCH_CL
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  CreatedAt: createdTime_t
  WorkbenchLink: workbenchLink_s
  XDRCustomerID: xdrCustomerID_g
  Provider: alertProvider_s
  PriorityScore: priorityScore_d
  WorkbenchID: workbenchId_s
  Severity: severity_s
  WorkbenchName: workbenchName_s
  ImpactScopeSummary: impactScope_Summary_s
description: |
    'This Query creates an incident based on Trend Micro Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage.'
queryPeriod: 5m
alertDetailsOverride:
  alertSeverityColumnName: Severity
  alertDescriptionFormat: '{{description_s}}'
  alertTacticsColumnName: 
  alertDisplayNameFormat: '{{workbenchName_s}}'
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Vision One/Analytic Rules/Create Incident for XDR Alerts.yaml
name: Create Incident for XDR Alerts
version: 1.0.2
alertRuleTemplateName: 
tactics: 
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Create Incident for XDR Alerts",
        "description": "'This Query creates an incident based on Trend Micro Vision One Workbench Alerts and maps the impacted entities for Microsoft Sentinel usage.'\n",
        "severity": "High",
        "enabled": true,
        "query": "TrendMicro_XDR_WORKBENCH_CL\n| extend Severity = case(severity_s == \"low\", \"Informational\",\n                        severity_s == \"medium\", \"Low\",\n                        severity_s == \"high\", \"Medium\",\n                        \"High\"\n                        )\n| extend \n    UserAccountName_s = todynamic(UserAccountName_s)[0],\n    UserAccountNTDomain_s = todynamic(UserAccountNTDomain_s)[0],\n    FileName_s = todynamic(FileName_s)[0],\n    FileDirectory_s = todynamic(FileDirectory_s)[0],\n    ProcessCommandLine_s = todynamic(ProcessCommandLine_s)[0],\n    RegistryKey_s = todynamic(RegistryKey_s)[0],\n    RegistryValue_s = todynamic(RegistryValue_s)[0],\n    RegistryValueName_s = todynamic(RegistryValueName_s)[0]\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": null,
        "techniques": null,
        "alertRuleTemplateName": "0febd8cc-1b8d-45ed-87b3-e1e8a57d14cd",
        "incidentConfiguration": {
          "groupingConfiguration": {
            "groupByAlertDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5M",
            "groupByCustomDetails": [
              "WorkbenchID"
            ],
            "reopenClosedIncident": false,
            "enabled": true,
            "matchingMethod": "Selected"
          },
          "createIncident": true
        },
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "alertDetailsOverride": {
          "alertSeverityColumnName": "Severity",
          "alertDisplayNameFormat": "{{workbenchName_s}}",
          "alertTacticsColumnName": null,
          "alertDescriptionFormat": "{{description_s}}"
        },
        "customDetails": {
          "CreatedAt": "createdTime_t",
          "WorkbenchLink": "workbenchLink_s",
          "XDRCustomerID": "xdrCustomerID_g",
          "Provider": "alertProvider_s",
          "PriorityScore": "priorityScore_d",
          "WorkbenchID": "workbenchId_s",
          "Severity": "severity_s",
          "WorkbenchName": "workbenchName_s",
          "ImpactScopeSummary": "impactScope_Summary_s"
        },
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "UserAccountName_s"
              },
              {
                "identifier": "NTDomain",
                "columnName": "UserAccountNTDomain_s"
              }
            ]
          },
          {
            "entityType": "File",
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "FileName_s"
              },
              {
                "identifier": "Directory",
                "columnName": "FileDirectory_s"
              }
            ]
          },
          {
            "entityType": "Process",
            "fieldMappings": [
              {
                "identifier": "CommandLine",
                "columnName": "ProcessCommandLine_s"
              }
            ]
          },
          {
            "entityType": "RegistryKey",
            "fieldMappings": [
              {
                "identifier": "Key",
                "columnName": "RegistryKey_s"
              }
            ]
          },
          {
            "entityType": "RegistryValue",
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "ProcessCommandLine_s"
              },
              {
                "identifier": "Value",
                "columnName": "RegistryValue_s"
              }
            ]
          }
        ],
        "templateVersion": "1.0.2",
        "status": "Available",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Trend Micro Vision One/Analytic Rules/Create Incident for XDR Alerts.yaml"
      }
    }
  ]
}