Dynatrace Application Security - Attack detection

Back


Id	1b0b2065-8bac-5a00-83c4-1b58f69ac212
Rulename	Dynatrace Application Security - Attack detection
Description	Dynatrace has detected an ongoing attack in your environment.
Severity	High
Tactics	Execution Impact InitialAccess PrivilegeEscalation
Techniques	T1059 T1565 T1190 T1068
Required data connectors	DynatraceAttacks
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml
Version	1.0.1
Arm template	1b0b2065-8bac-5a00-83c4-1b58f69ac212.json

KQL

DynatraceAttacks
| where State != 'ALLOWLISTED'
| summarize  arg_max(TimeStamp, *) by AttackId

YAML

description: |
    'Dynatrace has detected an ongoing attack in your environment.'
tactics:
- Execution
- Impact
- InitialAccess
- PrivilegeEscalation
severity: High
entityMappings:
- fieldMappings:
  - columnName: host
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: url
    identifier: Url
  entityType: URL
- fieldMappings:
  - columnName: sourceIp
    identifier: Address
  entityType: IP
queryFrequency: 1d
triggerOperator: gt
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  DynatraceAttacks
  | where State != 'ALLOWLISTED'
  | summarize  arg_max(TimeStamp, *) by AttackId  
customDetails:
  DisplayIdentifier: DisplayId
  AttackType: AttackType
  AttackIdentifier: AttackId
  AttackState: State
name: Dynatrace Application Security - Attack detection
alertDetailsOverride:
  alertDescriptionFormat: |
        Dynatrace has detected an ongoing attack in your environment which was {{State}}.
  alertDisplayNameFormat: 'Dynatrace Attack {{State}} - {{DisplayId}} : {{DisplayName}}'
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: P7D
    reopenClosedIncident: true
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
version: 1.0.1
triggerThreshold: 0
id: 1b0b2065-8bac-5a00-83c4-1b58f69ac212
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml
relevantTechniques:
- T1059
- T1565
- T1190
- T1068
queryPeriod: 1d
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - DynatraceAttacks
  connectorId: DynatraceAttacks

ARM