Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Dynatrace Application Security - Attack detection

Back
Id1b0b2065-8bac-5a00-83c4-1b58f69ac212
RulenameDynatrace Application Security - Attack detection
DescriptionDynatrace has detected an ongoing attack in your environment.
SeverityHigh
TacticsExecution
Impact
InitialAccess
PrivilegeEscalation
TechniquesT1059
T1565
T1190
T1068
Required data connectorsDynatraceAttacks
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml
Version1.0.0
Arm template1b0b2065-8bac-5a00-83c4-1b58f69ac212.json
Deploy To Azure
DynatraceAttacks
| where State != 'ALLOWLISTED'
| summarize  arg_max(TimeStamp, *) by AttackId
query: |
  DynatraceAttacks
  | where State != 'ALLOWLISTED'
  | summarize  arg_max(TimeStamp, *) by AttackId  
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
customDetails:
  AttackType: AttackType
  DisplayIdentifier: DisplayId
  AttackIdentifier: AttackId
  AttackState: State
name: Dynatrace Application Security - Attack detection
requiredDataConnectors:
- connectorId: DynatraceAttacks
  dataTypes:
  - DynatraceAttacks
id: 1b0b2065-8bac-5a00-83c4-1b58f69ac212
queryFrequency: 1d
suppressionDuration: 5h
kind: Scheduled
tactics:
- Execution
- Impact
- InitialAccess
- PrivilegeEscalation
status: Available
relevantTechniques:
- T1059
- T1565
- T1190
- T1068
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml
queryPeriod: 1d
version: 1.0.0
severity: High
triggerOperator: gt
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: true
    lookbackDuration: 7d
    reopenClosedIncident: true
  createIncident: true
suppressionEnabled: false
alertDetailsOverride:
  alertDescriptionFormat: |
        Dynatrace has detected an ongoing attack in your environment which was {{State}}.
  alertDisplayNameFormat: 'Dynatrace Attack {{State}} - {{DisplayId}} : {{DisplayName}}'
description: |
    'Dynatrace has detected an ongoing attack in your environment.'
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: host
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: url
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: sourceIp
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1b0b2065-8bac-5a00-83c4-1b58f69ac212')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1b0b2065-8bac-5a00-83c4-1b58f69ac212')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Dynatrace Application Security - Attack detection",
        "description": "'Dynatrace has detected an ongoing attack in your environment.'\n",
        "severity": "High",
        "enabled": true,
        "query": "DynatraceAttacks\n| where State != 'ALLOWLISTED'\n| summarize  arg_max(TimeStamp, *) by AttackId\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Impact",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1059",
          "T1565",
          "T1190",
          "T1068"
        ],
        "alertRuleTemplateName": "1b0b2065-8bac-5a00-83c4-1b58f69ac212",
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "matchingMethod": "AllEntities",
            "enabled": true,
            "lookbackDuration": "P7D",
            "reopenClosedIncident": true
          }
        },
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Dynatrace has detected an ongoing attack in your environment which was {{State}}.\n",
          "alertDisplayNameFormat": "Dynatrace Attack {{State}} - {{DisplayId}} : {{DisplayName}}"
        },
        "customDetails": {
          "AttackType": "AttackType",
          "DisplayIdentifier": "DisplayId",
          "AttackIdentifier": "AttackId",
          "AttackState": "State"
        },
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "host",
                "identifier": "HostName"
              }
            ],
            "entityType": "Host"
          },
          {
            "fieldMappings": [
              {
                "columnName": "url",
                "identifier": "Url"
              }
            ],
            "entityType": "URL"
          },
          {
            "fieldMappings": [
              {
                "columnName": "sourceIp",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          }
        ],
        "status": "Available",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml",
        "templateVersion": "1.0.0"
      }
    }
  ]
}