Dynatrace Application Security - Code-Level runtime vulnerability detection

Back


Id	305093b4-0fa2-57bc-bced-caea782a6e9c
Rulename	Dynatrace Application Security - Code-Level runtime vulnerability detection
Description	Detect Code-level runtime vulnerabilities in your environment
Severity	Medium
Tactics	DefenseEvasion Execution Impact InitialAccess LateralMovement Persistence PrivilegeEscalation
Required data connectors	DynatraceRuntimeVulnerabilities
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_CodeLevelVulnerabilityDetection.yaml
Version	1.0.3
Arm template	305093b4-0fa2-57bc-bced-caea782a6e9c.json

KQL

DynatraceSecurityProblems
| where VulnerabilityType == "CODE_LEVEL" and DAVISRiskLevel == "CRITICAL" and Muted == false
| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId

YAML

entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: Url
  entityType: URL
triggerThreshold: 0
queryPeriod: 1d
name: Dynatrace Application Security - Code-Level runtime vulnerability detection
alertDetailsOverride:
  alertSeverityColumnName: Severity
  alertDescriptionFormat: |
        Code-Level runtime vulnerability ({{ExternalVulnerabilityId}}) detected in package ({{PackageName}}), more details available from Dynatrace at {{Url}}.
  alertDisplayNameFormat: 'Dynatrace Code-Level runtime vulnerability detected - {{DisplayId}} : {{Title}}'
triggerOperator: gt
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_CodeLevelVulnerabilityDetection.yaml
requiredTechniques:
- T1140
- T1059
- T1565
- T1659
- T1210
- T1554
- T1548
version: 1.0.3
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  DynatraceSecurityProblems
  | where VulnerabilityType == "CODE_LEVEL" and DAVISRiskLevel == "CRITICAL" and Muted == false
  | summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId  
requiredDataConnectors:
- connectorId: DynatraceRuntimeVulnerabilities
  dataTypes:
  - DynatraceSecurityProblems
tactics:
- DefenseEvasion
- Execution
- Impact
- InitialAccess
- LateralMovement
- Persistence
- PrivilegeEscalation
status: Available
description: Detect Code-level runtime vulnerabilities in your environment
severity: Medium
customDetails:
  DAVISRiskScore: DAVISRiskScore
  DAVISRiskVector: DAVISRiskVector
  DAVISRiskLevel: DAVISRiskLevel
  CVEIds: CVEIds
  DAVISPublicExploit: DAVISPublicExploit
  SecProbIdentifier: SecurityProblemId
  DisplayIdentifier: DisplayId
  PackageName: PackageName
  Technology: Technology
  SecurityProblemUrl: Url
  DAVISDataAssets: DAVISDataAssets
  ExternVulnIdentifier: ExternalVulnerabilityId
  DAVISExposure: DAVISExposure
  VulnerabilityType: VulnerabilityType
  DAVISVulnFuncUsage: DAVISVulnerableFunctionUsage
id: 305093b4-0fa2-57bc-bced-caea782a6e9c
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
queryFrequency: 1d

ARM