Cortex XDR Incident - Low

Back


Id	1426bbcf-a9ae-4aa5-9da6-abbf48f04115
Rulename	Cortex XDR Incident - Low
Description	A new incident was created in the Cortex XDR portal with a severity “Low”. Click on the events for incident details.
Severity	Low
Required data connectors	CortexXDR
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cortex XDR/Analytic Rules/CortexXDR_Low.yaml
Version	1.0.0
Arm template	1426bbcf-a9ae-4aa5-9da6-abbf48f04115.json

KQL

CortexXDR_Incidents_CL
| where severity_s contains "low"
| where status_s !contains "resolved_auto"
// the below line filters for incidents that has at least one user or one host in it. Comment the below line if you want to generated incidents that have 0 user or 0 host as well
| where host_count_d > 0 or user_count_d > 0
| project TimeGenerated, incident_id_s, status_s, severity_s, incident_sources_s, description_s, xdr_url_s, hosts_s, users_s, alert_categories_s, host_count_d, user_count_d, alert_count_d, creation_time_d, modification_time_d

YAML

alertDetailsOverride: 
queryFrequency: 5m
id: 1426bbcf-a9ae-4aa5-9da6-abbf48f04115
entityMappings:
- fieldMappings:
  - columnName: users_s
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: xdr_url_s
    identifier: Url
  entityType: URL
- fieldMappings:
  - columnName: hosts_s
    identifier: HostName
  entityType: Host
tactics: []
suppressionDuration: 5h
requiredDataConnectors:
- connectorId: CortexXDR
  dataTypes:
  - CortexXDR_Incidents_CL
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cortex XDR/Analytic Rules/CortexXDR_Low.yaml
suppressionEnabled: false
eventGroupingSettings:
  aggregationKind: SingleAlert
query: |
  CortexXDR_Incidents_CL
  | where severity_s contains "low"
  | where status_s !contains "resolved_auto"
  // the below line filters for incidents that has at least one user or one host in it. Comment the below line if you want to generated incidents that have 0 user or 0 host as well
  | where host_count_d > 0 or user_count_d > 0
  | project TimeGenerated, incident_id_s, status_s, severity_s, incident_sources_s, description_s, xdr_url_s, hosts_s, users_s, alert_categories_s, host_count_d, user_count_d, alert_count_d, creation_time_d, modification_time_d  
description: |
    'A new incident was created in the Cortex XDR portal with a severity "Low". Click on the events for incident details. '
relevantTechniques: []
customDetails: 
triggerThreshold: 0
queryPeriod: 5m
triggerOperator: gt
name: Cortex XDR Incident - Low
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    enabled: true
    lookbackDuration: 5h
  createIncident: true
severity: Low
sentinelEntitiesMappings: 
version: 1.0.0

ARM