BitSight - diligence risk category detected
Id | 161ed3ac-b242-4b13-8c6b-58716e5e9972 |
Rulename | BitSight - diligence risk category detected |
Description | Rule helps to detect whenever there is a diligence risk category found in BitSight. |
Severity | Medium |
Tactics | Execution |
Required data connectors | BitSight |
Kind | Scheduled |
Query frequency | 1d |
Query period | 24h |
Trigger threshold | 0 |
Trigger operator | GreaterThan |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightDiligenceRiskCategoryDetected.yaml |
Version | 1.0.0 |
Arm template | 161ed3ac-b242-4b13-8c6b-58716e5e9972.json |
let timeframe = 24h;
BitSightFindingsData
| where ingestion_time() > ago(timeframe)
| where RiskCategory == "Diligence"
| extend Severity = toreal(Severity)
| extend Severity = case( Severity <= 6.9 and Severity >= 4.0, "Low",
Severity <= 8.9 and Severity >= 7.0, "Medium",
Severity <= 10.0 and Severity >= 9.0, "High",
"Informational")
| project FirstSeen, CompanyName, Severity, RiskCategory, TemporaryId, RiskVector
severity: Medium
incidentConfiguration:
createIncident: false
requiredDataConnectors:
- dataTypes:
- BitSightFindingsData
connectorId: BitSight
alertDetailsOverride:
alertSeverityColumnName: Severity
alertDescriptionFormat: 'Alert is generated for {{CompanyName}}.\n\nRisk Vector: {{RiskVector}}\nTemporaryId: {{TemporaryId}}\nRisk Category: Diligence'
alertDisplayNameFormat: 'BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight'
id: 161ed3ac-b242-4b13-8c6b-58716e5e9972
tactics:
- Execution
queryFrequency: 1d
eventGroupingSettings:
aggregationKind: AlertPerResult
triggerOperator: GreaterThan
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightDiligenceRiskCategoryDetected.yaml
description: |
'Rule helps to detect whenever there is a diligence risk category found in BitSight.'
triggerThreshold: 0
kind: Scheduled
name: BitSight - diligence risk category detected
query: |
let timeframe = 24h;
BitSightFindingsData
| where ingestion_time() > ago(timeframe)
| where RiskCategory == "Diligence"
| extend Severity = toreal(Severity)
| extend Severity = case( Severity <= 6.9 and Severity >= 4.0, "Low",
Severity <= 8.9 and Severity >= 7.0, "Medium",
Severity <= 10.0 and Severity >= 9.0, "High",
"Informational")
| project FirstSeen, CompanyName, Severity, RiskCategory, TemporaryId, RiskVector
entityMappings:
- entityType: Malware
fieldMappings:
- columnName: RiskVector
identifier: Name
- columnName: RiskCategory
identifier: Category
status: Available
version: 1.0.0
queryPeriod: 24h
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/161ed3ac-b242-4b13-8c6b-58716e5e9972')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/161ed3ac-b242-4b13-8c6b-58716e5e9972')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01-preview",
"properties": {
"displayName": "BitSight - diligence risk category detected",
"description": "'Rule helps to detect whenever there is a diligence risk category found in BitSight.'\n",
"severity": "Medium",
"enabled": true,
"query": "let timeframe = 24h;\nBitSightFindingsData\n| where ingestion_time() > ago(timeframe)\n| where RiskCategory == \"Diligence\"\n| extend Severity = toreal(Severity)\n| extend Severity = case( Severity <= 6.9 and Severity >= 4.0, \"Low\",\n Severity <= 8.9 and Severity >= 7.0, \"Medium\",\n Severity <= 10.0 and Severity >= 9.0, \"High\",\n \"Informational\")\n| project FirstSeen, CompanyName, Severity, RiskCategory, TemporaryId, RiskVector\n",
"queryFrequency": "P1D",
"queryPeriod": "PT24H",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Execution"
],
"alertRuleTemplateName": "161ed3ac-b242-4b13-8c6b-58716e5e9972",
"incidentConfiguration": {
"createIncident": false
},
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"alertDetailsOverride": {
"alertSeverityColumnName": "Severity",
"alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRisk Vector: {{RiskVector}}\\nTemporaryId: {{TemporaryId}}\\nRisk Category: Diligence",
"alertDisplayNameFormat": "BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight"
},
"customDetails": null,
"entityMappings": [
{
"fieldMappings": [
{
"identifier": "Name",
"columnName": "RiskVector"
},
{
"identifier": "Category",
"columnName": "RiskCategory"
}
],
"entityType": "Malware"
}
],
"status": "Available",
"templateVersion": "1.0.0",
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightDiligenceRiskCategoryDetected.yaml"
}
}
]
}