Armorblox Needs Review Alert

Back


Id	322d4765-be6b-4868-9e3f-138a4f339dd6
Rulename	Armorblox Needs Review Alert
Description	This rule generates an alert for an Armorblox incident where the remediation action is “Needs Review”.
Severity	Medium
Required data connectors	Armorblox
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Armorblox/Analytic Rules/ArmorbloxNeedsReviewAlert.yaml
Version	1.0.2
Arm template	322d4765-be6b-4868-9e3f-138a4f339dd6.json

KQL

Armorblox_CL 
| where remediation_actions_s contains "Needs Review"
| extend users_json = parse_json(users_s)
| extend Name = users_json[0].name, Email = users_json[0].email
| project-away users_json

YAML

name: Armorblox Needs Review Alert
kind: Scheduled
tactics: []
triggerThreshold: 0
triggerOperator: GreaterThan
version: 1.0.2
status: Available
alertDetailsOverride:
  alertDisplayNameFormat: Alert from Armorblox
  alertDescriptionFormat: 'Incident {{id_s}} generated at {{date_t}} needs review '
  alertSeverityColumnName: priority_s
queryFrequency: 10m
id: 322d4765-be6b-4868-9e3f-138a4f339dd6
requiredDataConnectors:
- connectorId: Armorblox
  dataTypes:
  - Armorblox_CL
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: []
description: |
    'This rule generates an alert for an Armorblox incident where the remediation action is "Needs Review".'
customDetails:
  IncidentId: id_s
  RemediationAction: remediation_actions_s
entityMappings:
- entityType: Mailbox
  fieldMappings:
  - columnName: Email
    identifier: MailboxPrimaryAddress
  - columnName: Name
    identifier: DisplayName
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Armorblox/Analytic Rules/ArmorbloxNeedsReviewAlert.yaml
queryPeriod: 10m
severity: Medium
query: |
  Armorblox_CL 
  | where remediation_actions_s contains "Needs Review"
  | extend users_json = parse_json(users_s)
  | extend Name = users_json[0].name, Email = users_json[0].email
  | project-away users_json

ARM