Cynerio - Medical device scanning

Back


Id	211e9f49-3fca-4598-bc6e-e2c28d86e72c
Rulename	Cynerio - Medical device scanning
Description	Medical device is scanned with vulnerability scanner
Severity	Medium
Tactics	LateralMovement
Techniques	T0866
Required data connectors	CynerioSecurityEvents
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic Rules/MedicalDeviceScanning.yaml
Version	1.0.0
Arm template	211e9f49-3fca-4598-bc6e-e2c28d86e72c.json

KQL

CynerioEvent_CL
| where TimeGenerated > ago(24h)
| where module_s == 'IDS'
| where title_s == 'Scanner Activity'

YAML

relevantTechniques:
- T0866
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: asset_ip_s
    identifier: Address
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.0
id: 211e9f49-3fca-4598-bc6e-e2c28d86e72c
severity: Medium
kind: Scheduled
queryFrequency: 5h
description: Medical device is scanned with vulnerability scanner
requiredDataConnectors:
- connectorId: CynerioSecurityEvents
  dataTypes:
  - CynerioEvent_CL
triggerOperator: gt
name: Cynerio - Medical device scanning
tactics:
- LateralMovement
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic Rules/MedicalDeviceScanning.yaml
triggerThreshold: 0
queryPeriod: 5h
query: |
  CynerioEvent_CL
  | where TimeGenerated > ago(24h)
  | where module_s == 'IDS'
  | where title_s == 'Scanner Activity'  
customDetails:
  DeviceType: asset_type_s

ARM