BitSight - diligence risk category detected

Back


Id	161ed3ac-b242-4b13-8c6b-58716e5e9972
Rulename	BitSight - diligence risk category detected
Description	Rule helps to detect whenever there is a diligence risk category found in BitSight.
Severity	Medium
Tactics	Execution Reconnaissance
Techniques	T1203 T1595.002
Required data connectors	BitSight
Kind	Scheduled
Query frequency	1d
Query period	24h
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightDiligenceRiskCategoryDetected.yaml
Version	1.0.2
Arm template	161ed3ac-b242-4b13-8c6b-58716e5e9972.json

KQL

let timeframe = 24h;
BitSightFindingsData
| where ingestion_time() > ago(timeframe)
| where RiskCategory == "Diligence"
| extend Severity = toreal(Severity)
| extend Severity = case( Severity <= 6.9 and Severity >= 4.0, "Low",
                          Severity <= 8.9 and Severity >= 7.0, "Medium",
                          Severity <= 10.0 and Severity >= 9.0, "High",
                          "Informational")
| project FirstSeen, CompanyName, Severity, RiskCategory, TemporaryId, RiskVector

YAML

status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightDiligenceRiskCategoryDetected.yaml
alertDetailsOverride:
  alertDisplayNameFormat: 'BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight'
  alertDescriptionFormat: 'Alert is generated for {{CompanyName}}.\n\nRisk Vector: {{RiskVector}}\nTemporaryId: {{TemporaryId}}\nRisk Category: Diligence'
  alertSeverityColumnName: Severity
query: |
  let timeframe = 24h;
  BitSightFindingsData
  | where ingestion_time() > ago(timeframe)
  | where RiskCategory == "Diligence"
  | extend Severity = toreal(Severity)
  | extend Severity = case( Severity <= 6.9 and Severity >= 4.0, "Low",
                            Severity <= 8.9 and Severity >= 7.0, "Medium",
                            Severity <= 10.0 and Severity >= 9.0, "High",
                            "Informational")
  | project FirstSeen, CompanyName, Severity, RiskCategory, TemporaryId, RiskVector  
requiredDataConnectors:
- dataTypes:
  - BitSightFindingsData
  connectorId: BitSight
incidentConfiguration:
  createIncident: false
tactics:
- Execution
- Reconnaissance
name: BitSight - diligence risk category detected
relevantTechniques:
- T1203
- T1595.002
severity: Medium
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: RiskVector
  - identifier: Category
    columnName: RiskCategory
  entityType: Malware
kind: Scheduled
queryFrequency: 1d
description: |
    'Rule helps to detect whenever there is a diligence risk category found in BitSight.'
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
triggerOperator: GreaterThan
version: 1.0.2
queryPeriod: 24h
id: 161ed3ac-b242-4b13-8c6b-58716e5e9972

ARM