Create Incidents from IronDefense

Back


Id	3cf46cb9-99d5-42ee-a43c-7bd88ea394a1
Rulename	Create Incidents from IronDefense
Description	Creates incidents based on behavioral detections from IronDefense.
Severity	Medium
Required data connectors	IronNetIronDefense
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml
Version	1.0.1
Arm template	3cf46cb9-99d5-42ee-a43c-7bd88ea394a1.json

KQL

CommonSecurityLog
| where DeviceProduct == "IronDefense"
| summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
| extend Category = coalesce(column_ifexists("DeviceEventCategory",""),extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions))	
| extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
| extend AlertDescription = strcat(Category, ': ', Subcategory)
| extend Status = tostring(DeviceCustomString2)
| extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))

YAML

kind: Scheduled
relevantTechniques: 
description: |
    'Creates incidents based on behavioral detections from IronDefense.'
queryPeriod: 5m
queryFrequency: 5m
alertDetailsOverride:
  alertSeverityColumnName: LogSeverity
  alertDisplayNameFormat: |
        {{Category}}: {{Subcategory}} ({{DeviceCustomString4}})
  alertDescriptionFormat: |
        IronDefense detected suspicious activity on {{TimeGenerated}} and categorized it as "{{AlertDescription}}".  View full details in IronVue: {{IronVueUrl}}
tactics: 
name: Create Incidents from IronDefense
requiredDataConnectors:
- connectorId: IronNetIronDefense
  dataTypes:
  - CommonSecurityLog
customDetails:
  IronVueUrl: IronVueUrl
  AnalystSeverity: DeviceCustomString1
  AlertCreatedTime: TimeGenerated
  IronDefenseAlertId: DeviceCustomString4
  AnalystRating: LogSeverity
  IronDefenseStatus: Status
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DestinationIP
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: DestinationHostName
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: SourceHostName
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: RequestURL
triggerThreshold: 0
version: 1.0.1
id: 3cf46cb9-99d5-42ee-a43c-7bd88ea394a1
query: |
  CommonSecurityLog
  | where DeviceProduct == "IronDefense"
  | summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
  | extend Category = coalesce(column_ifexists("DeviceEventCategory",""),extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions))	
  | extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
  | extend AlertDescription = strcat(Category, ': ', Subcategory)
  | extend Status = tostring(DeviceCustomString2)
  | extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))  
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml
severity: Medium

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3cf46cb9-99d5-42ee-a43c-7bd88ea394a1')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3cf46cb9-99d5-42ee-a43c-7bd88ea394a1')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "IronDefense detected suspicious activity on {{TimeGenerated}} and categorized it as \"{{AlertDescription}}\".  View full details in IronVue: {{IronVueUrl}}\n",
          "alertDisplayNameFormat": "{{Category}}: {{Subcategory}} ({{DeviceCustomString4}})\n",
          "alertSeverityColumnName": "LogSeverity"
        },
        "alertRuleTemplateName": "3cf46cb9-99d5-42ee-a43c-7bd88ea394a1",
        "customDetails": {
          "AlertCreatedTime": "TimeGenerated",
          "AnalystRating": "LogSeverity",
          "AnalystSeverity": "DeviceCustomString1",
          "IronDefenseAlertId": "DeviceCustomString4",
          "IronDefenseStatus": "Status",
          "IronVueUrl": "IronVueUrl"
        },
        "description": "'Creates incidents based on behavioral detections from IronDefense.'\n",
        "displayName": "Create Incidents from IronDefense",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DestinationIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DestinationHostName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHostName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "RequestURL",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml",
        "query": "CommonSecurityLog\n| where DeviceProduct == \"IronDefense\"\n| summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2\n| extend Category = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),extract(@'cat=([^;]+)(\\;|$)', 1, AdditionalExtensions))\t\n| extend Subcategory = extract(@'subcat=([^;]+)(\\;|$)', 1, AdditionalExtensions)\n| extend AlertDescription = strcat(Category, ': ', Subcategory)\n| extend Status = tostring(DeviceCustomString2)\n| extend IronVueUrl = replace(@'\\\\', @'', tostring(DeviceCustomString3))\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": null,
        "techniques": null,
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}