No traffic on Sensor Detected (Microsoft Defender for IoT)

Back


Id	208c3f5b-3ba2-49b5-9bca-c44e58cd5fd3
Rulename	No traffic on Sensor Detected (Microsoft Defender for IoT)
Description	This alert leverages Defender for IoT to detect that a sensor can no longer detect the network traffic, which indicates that the system is potentially insecure.
Severity	High
Tactics	InhibitResponseFunction
Techniques	T0881
Required data connectors	IoT
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTINoSensorTrafficDetected.yaml
Version	1.0.1
Arm template	208c3f5b-3ba2-49b5-9bca-c44e58cd5fd3.json

KQL

SecurityAlert
| where ProviderName == "IoTSecurity"
| where AlertName == "No Traffic Detected on Sensor Interface" 
| extend ExtendedProperties = parse_json(ExtendedProperties)
| where tostring(ExtendedProperties.isNew) == "True"
| extend DeviceId = tostring(ExtendedProperties.DeviceId), 
         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
         Protocol = tostring(ExtendedProperties.Protocol), 
         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
| project
  TimeGenerated,
  DeviceId,
  ProductName,
  ProductComponentName,
  AlertSeverity,
  AlertName,
  Description,
  Protocol,
  SourceDeviceAddress,
  DestDeviceAddress,
  RemediationSteps,
  Tactics,
  Entities,
  VendorOriginalId,
  AlertLink,
  AlertManagementUri,
  Techniques

YAML

sentinelEntitiesMappings:
- columnName: Entities
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTINoSensorTrafficDetected.yaml
description: |
    'This alert leverages Defender for IoT to detect that a sensor can no longer detect the network traffic, which indicates that the system is potentially insecure.'
triggerOperator: gt
customDetails:
  VendorOriginalId: VendorOriginalId
  Sensor: DeviceId
  AlertManagementUri: AlertManagementUri
  Protocol: Protocol
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - SecurityAlert (ASC for IoT)
  connectorId: IoT
queryFrequency: 1h
triggerThreshold: 0
tactics:
- InhibitResponseFunction
alertDetailsOverride:
  alertDescriptionFormat: (MDIoT) {{Description}}
  alertDynamicProperties:
  - value: ProductName
    alertProperty: ProductName
  - value: RemediationSteps
    alertProperty: RemediationSteps
  - value: Techniques
    alertProperty: Techniques
  - value: ProductComponentName
    alertProperty: ProductComponentName
  - value: AlertLink
    alertProperty: AlertLink
  alertSeverityColumnName: AlertSeverity
  alertDisplayNameFormat: (MDIoT) {{AlertName}}
  alertTacticsColumnName: Tactics
query: |
  SecurityAlert
  | where ProviderName == "IoTSecurity"
  | where AlertName == "No Traffic Detected on Sensor Interface" 
  | extend ExtendedProperties = parse_json(ExtendedProperties)
  | where tostring(ExtendedProperties.isNew) == "True"
  | extend DeviceId = tostring(ExtendedProperties.DeviceId), 
           SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
           DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
           RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
           Protocol = tostring(ExtendedProperties.Protocol), 
           AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
  | project
    TimeGenerated,
    DeviceId,
    ProductName,
    ProductComponentName,
    AlertSeverity,
    AlertName,
    Description,
    Protocol,
    SourceDeviceAddress,
    DestDeviceAddress,
    RemediationSteps,
    Tactics,
    Entities,
    VendorOriginalId,
    AlertLink,
    AlertManagementUri,
    Techniques  
status: Available
kind: Scheduled
relevantTechniques:
- T0881
version: 1.0.1
id: 208c3f5b-3ba2-49b5-9bca-c44e58cd5fd3
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings: 
name: No traffic on Sensor Detected (Microsoft Defender for IoT)

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/208c3f5b-3ba2-49b5-9bca-c44e58cd5fd3')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/208c3f5b-3ba2-49b5-9bca-c44e58cd5fd3')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "No traffic on Sensor Detected (Microsoft Defender for IoT)",
        "description": "'This alert leverages Defender for IoT to detect that a sensor can no longer detect the network traffic, which indicates that the system is potentially insecure.'\n",
        "severity": "High",
        "enabled": true,
        "query": "SecurityAlert\n| where ProviderName == \"IoTSecurity\"\n| where AlertName == \"No Traffic Detected on Sensor Interface\" \n| extend ExtendedProperties = parse_json(ExtendedProperties)\n| where tostring(ExtendedProperties.isNew) == \"True\"\n| extend DeviceId = tostring(ExtendedProperties.DeviceId), \n         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), \n         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), \n         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), \n         Protocol = tostring(ExtendedProperties.Protocol), \n         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)\n| project\n  TimeGenerated,\n  DeviceId,\n  ProductName,\n  ProductComponentName,\n  AlertSeverity,\n  AlertName,\n  Description,\n  Protocol,\n  SourceDeviceAddress,\n  DestDeviceAddress,\n  RemediationSteps,\n  Tactics,\n  Entities,\n  VendorOriginalId,\n  AlertLink,\n  AlertManagementUri,\n  Techniques\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InhibitResponseFunction"
        ],
        "techniques": [
          "T0881"
        ],
        "alertRuleTemplateName": "208c3f5b-3ba2-49b5-9bca-c44e58cd5fd3",
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "alertDetailsOverride": {
          "alertDynamicProperties": [
            {
              "value": "ProductName",
              "alertProperty": "ProductName"
            },
            {
              "value": "RemediationSteps",
              "alertProperty": "RemediationSteps"
            },
            {
              "value": "Techniques",
              "alertProperty": "Techniques"
            },
            {
              "value": "ProductComponentName",
              "alertProperty": "ProductComponentName"
            },
            {
              "value": "AlertLink",
              "alertProperty": "AlertLink"
            }
          ],
          "alertDisplayNameFormat": "(MDIoT) {{AlertName}}",
          "alertDescriptionFormat": "(MDIoT) {{Description}}",
          "alertSeverityColumnName": "AlertSeverity",
          "alertTacticsColumnName": "Tactics"
        },
        "customDetails": {
          "VendorOriginalId": "VendorOriginalId",
          "Sensor": "DeviceId",
          "AlertManagementUri": "AlertManagementUri",
          "Protocol": "Protocol"
        },
        "entityMappings": null,
        "sentinelEntitiesMappings": [
          {
            "columnName": "Entities"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTINoSensorTrafficDetected.yaml",
        "templateVersion": "1.0.1",
        "status": "Available"
      }
    }
  ]
}