Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Dynatrace Application Security - Attack detection

Back
Id1b0b2065-8bac-5a00-83c4-1b58f69ac212
RulenameDynatrace Application Security - Attack detection
DescriptionDynatrace has detected an ongoing attack in your environment.
SeverityHigh
TacticsExecution
Impact
InitialAccess
PrivilegeEscalation
TechniquesT1059
T1565
T1190
T1068
Required data connectorsDynatraceAttacks
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml
Version3.0.1
Arm template1b0b2065-8bac-5a00-83c4-1b58f69ac212.json
Deploy To Azure
DynatraceAttacks
| where State != 'ALLOWLISTED'
| summarize  arg_max(TimeStamp, *) by AttackId
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: host
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: url
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: sourceIp
alertDetailsOverride:
  alertDescriptionFormat: |
        Dynatrace has detected an ongoing attack in your environment which was {{State}}.
  alertDisplayNameFormat: 'Dynatrace Attack {{State}} - {{DisplayId}} : {{DisplayName}}'
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - DynatraceAttacks
  connectorId: DynatraceAttacks
queryPeriod: 1d
status: Available
kind: Scheduled
description: |
    'Dynatrace has detected an ongoing attack in your environment.'
customDetails:
  AttackState: State
  AttackIdentifier: AttackId
  AttackType: AttackType
  DisplayIdentifier: DisplayId
query: |
  DynatraceAttacks
  | where State != 'ALLOWLISTED'
  | summarize  arg_max(TimeStamp, *) by AttackId  
relevantTechniques:
- T1059
- T1565
- T1190
- T1068
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml
severity: High
triggerThreshold: 0
name: Dynatrace Application Security - Attack detection
tactics:
- Execution
- Impact
- InitialAccess
- PrivilegeEscalation
version: 3.0.1
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: true
    enabled: true
    matchingMethod: AllEntities
    lookbackDuration: P7D
id: 1b0b2065-8bac-5a00-83c4-1b58f69ac212
queryFrequency: 1d
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2023-02-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/1b0b2065-8bac-5a00-83c4-1b58f69ac212')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/1b0b2065-8bac-5a00-83c4-1b58f69ac212')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Dynatrace has detected an ongoing attack in your environment which was {{State}}.\n",
          "alertDisplayNameFormat": "Dynatrace Attack {{State}} - {{DisplayId}} : {{DisplayName}}"
        },
        "alertRuleTemplateName": "1b0b2065-8bac-5a00-83c4-1b58f69ac212",
        "customDetails": {
          "AttackIdentifier": "AttackId",
          "AttackState": "State",
          "AttackType": "AttackType",
          "DisplayIdentifier": "DisplayId"
        },
        "description": "'Dynatrace has detected an ongoing attack in your environment.'\n",
        "displayName": "Dynatrace Application Security - Attack detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "host",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "url",
                "identifier": "Url"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "sourceIp",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "P7D",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": true
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_AttackDetection.yaml",
        "query": "DynatraceAttacks\n| where State != 'ALLOWLISTED'\n| summarize  arg_max(TimeStamp, *) by AttackId\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "severity": "High",
        "status": "Available",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Impact",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1059",
          "T1068",
          "T1190",
          "T1565"
        ],
        "templateVersion": "3.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}