CommonSecurityLog
| where DeviceProduct == "IronDefense"
| summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
| extend Category = coalesce(column_ifexists("DeviceEventCategory",""),extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions))
| extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
| extend AlertDescription = strcat(Category, ': ', Subcategory)
| extend Status = tostring(DeviceCustomString2)
| extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))
description: |
'Creates incidents based on behavioral detections from IronDefense.'
queryFrequency: 5m
status: Available
kind: Scheduled
relevantTechniques:
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml
requiredDataConnectors:
- connectorId: IronNetIronDefense
dataTypes:
- CommonSecurityLog
id: 3cf46cb9-99d5-42ee-a43c-7bd88ea394a1
severity: Medium
query: |
CommonSecurityLog
| where DeviceProduct == "IronDefense"
| summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
| extend Category = coalesce(column_ifexists("DeviceEventCategory",""),extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions))
| extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
| extend AlertDescription = strcat(Category, ': ', Subcategory)
| extend Status = tostring(DeviceCustomString2)
| extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))
tactics:
alertDetailsOverride:
alertDisplayNameFormat: |
{{Category}}: {{Subcategory}} ({{DeviceCustomString4}})
alertDescriptionFormat: |
IronDefense detected suspicious activity on {{TimeGenerated}} and categorized it as "{{AlertDescription}}". View full details in IronVue: {{IronVueUrl}}
alertSeverityColumnName: LogSeverity
customDetails:
AnalystSeverity: DeviceCustomString1
AnalystRating: LogSeverity
IronDefenseAlertId: DeviceCustomString4
IronVueUrl: IronVueUrl
IronDefenseStatus: Status
AlertCreatedTime: TimeGenerated
entityMappings:
- entityType: IP
fieldMappings:
- columnName: DestinationIP
identifier: Address
- entityType: IP
fieldMappings:
- columnName: SourceIP
identifier: Address
- entityType: Host
fieldMappings:
- columnName: DestinationHostName
identifier: FullName
- entityType: Host
fieldMappings:
- columnName: SourceHostName
identifier: FullName
- entityType: URL
fieldMappings:
- columnName: RequestURL
identifier: Url
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: AlertPerResult
queryPeriod: 5m
name: Create Incidents from IronDefense
triggerOperator: gt
version: 1.0.1
