Armorblox Needs Review Alert

Back


Id	322d4765-be6b-4868-9e3f-138a4f339dd6
Rulename	Armorblox Needs Review Alert
Description	This rule generates an alert for an Armorblox incident where the remediation action is “Needs Review”.
Severity	Medium
Required data connectors	Armorblox
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Armorblox/Analytic Rules/ArmorbloxNeedsReviewAlert.yaml
Version	1.0.2
Arm template	322d4765-be6b-4868-9e3f-138a4f339dd6.json

KQL

Armorblox_CL 
| where remediation_actions_s contains "Needs Review"
| extend users_json = parse_json(users_s)
| extend Name = users_json[0].name, Email = users_json[0].email
| project-away users_json

YAML

severity: Medium
queryFrequency: 10m
description: |
    'This rule generates an alert for an Armorblox incident where the remediation action is "Needs Review".'
query: |
  Armorblox_CL 
  | where remediation_actions_s contains "Needs Review"
  | extend users_json = parse_json(users_s)
  | extend Name = users_json[0].name, Email = users_json[0].email
  | project-away users_json  
alertDetailsOverride:
  alertDescriptionFormat: 'Incident {{id_s}} generated at {{date_t}} needs review '
  alertSeverityColumnName: priority_s
  alertDisplayNameFormat: Alert from Armorblox
requiredDataConnectors:
- connectorId: Armorblox
  dataTypes:
  - Armorblox_CL
kind: Scheduled
status: Available
name: Armorblox Needs Review Alert
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: []
tactics: []
version: 1.0.2
id: 322d4765-be6b-4868-9e3f-138a4f339dd6
customDetails:
  IncidentId: id_s
  RemediationAction: remediation_actions_s
triggerThreshold: 0
queryPeriod: 10m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Armorblox/Analytic Rules/ArmorbloxNeedsReviewAlert.yaml
triggerOperator: GreaterThan
entityMappings:
- fieldMappings:
  - columnName: Email
    identifier: MailboxPrimaryAddress
  - columnName: Name
    identifier: DisplayName
  entityType: Mailbox

ARM