Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Suspicious Mobile App INFO

Back
Id18155351-23b6-4684-bca6-23c11e4ff5c1
RulenameSuspicious Mobile App INFO
DescriptionNew Suspicious Mobile App with severity Informational found
SeverityInformational
TacticsResourceDevelopment
TechniquesT1587
T1588.002
Required data connectorsCBSPollingIDAzureFunctions
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/SuspiciousMobileAppINFO.yaml
Version1.0.2
Arm template18155351-23b6-4684-bca6-23c11e4ff5c1.json
Deploy To Azure
CBSLog_Azure_1_CL | where severity_s == "Informational" | where type_s == "Suspicious Mobile App" | where status_s != "Closed" or status_s != "Resolved" | where remarks_s == "New Suspicious Mobile App with severity Informational found"
tactics:
- ResourceDevelopment
query: |
    CBSLog_Azure_1_CL | where severity_s == "Informational" | where type_s == "Suspicious Mobile App" | where status_s != "Closed" or status_s != "Resolved" | where remarks_s == "New Suspicious Mobile App with severity Informational found"
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByCustomDetails: []
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    lookbackDuration: PT5H
queryFrequency: 5m
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: subject_s
  entityType: URL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/SuspiciousMobileAppINFO.yaml
queryPeriod: 5m
kind: Scheduled
version: 1.0.2
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: SingleAlert
suppressionEnabled: false
status: Available
relevantTechniques:
- T1587
- T1588.002
name: Suspicious Mobile App INFO
triggerThreshold: 0
severity: Informational
suppressionDuration: 5h
description: |
    'New Suspicious Mobile App with severity Informational found'
requiredDataConnectors:
- dataTypes:
  - CBSLog_Azure_1_CL
  connectorId: CBSPollingIDAzureFunctions
id: 18155351-23b6-4684-bca6-23c11e4ff5c1
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/18155351-23b6-4684-bca6-23c11e4ff5c1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/18155351-23b6-4684-bca6-23c11e4ff5c1')]",
      "properties": {
        "alertRuleTemplateName": "18155351-23b6-4684-bca6-23c11e4ff5c1",
        "customDetails": null,
        "description": "'New Suspicious Mobile App with severity Informational found'\n",
        "displayName": "Suspicious Mobile App INFO",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "subject_s",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/SuspiciousMobileAppINFO.yaml",
        "query": "CBSLog_Azure_1_CL | where severity_s == \"Informational\" | where type_s == \"Suspicious Mobile App\" | where status_s != \"Closed\" or status_s != \"Resolved\" | where remarks_s == \"New Suspicious Mobile App with severity Informational found\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [
          "T1588.002"
        ],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1587",
          "T1588"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}