Create Incidents from IronDefense

Back


Id	3cf46cb9-99d5-42ee-a43c-7bd88ea394a1
Rulename	Create Incidents from IronDefense
Description	Creates incidents based on behavioral detections from IronDefense.
Severity	Medium
Required data connectors	IronNetIronDefense
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml
Version	1.0.1
Arm template	3cf46cb9-99d5-42ee-a43c-7bd88ea394a1.json

KQL

CommonSecurityLog
| where DeviceProduct == "IronDefense"
| summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
| extend Category = coalesce(column_ifexists("DeviceEventCategory",""),extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions))	
| extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
| extend AlertDescription = strcat(Category, ': ', Subcategory)
| extend Status = tostring(DeviceCustomString2)
| extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))

YAML

alertDetailsOverride:
  alertDescriptionFormat: |
        IronDefense detected suspicious activity on {{TimeGenerated}} and categorized it as "{{AlertDescription}}".  View full details in IronVue: {{IronVueUrl}}
  alertSeverityColumnName: LogSeverity
  alertDisplayNameFormat: |
        {{Category}}: {{Subcategory}} ({{DeviceCustomString4}})
description: |
    'Creates incidents based on behavioral detections from IronDefense.'
kind: Scheduled
tactics: 
requiredDataConnectors:
- connectorId: IronNetIronDefense
  dataTypes:
  - CommonSecurityLog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml
severity: Medium
name: Create Incidents from IronDefense
customDetails:
  AnalystSeverity: DeviceCustomString1
  IronVueUrl: IronVueUrl
  IronDefenseStatus: Status
  AnalystRating: LogSeverity
  IronDefenseAlertId: DeviceCustomString4
  AlertCreatedTime: TimeGenerated
triggerThreshold: 0
queryPeriod: 5m
query: |
  CommonSecurityLog
  | where DeviceProduct == "IronDefense"
  | summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
  | extend Category = coalesce(column_ifexists("DeviceEventCategory",""),extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions))	
  | extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
  | extend AlertDescription = strcat(Category, ': ', Subcategory)
  | extend Status = tostring(DeviceCustomString2)
  | extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))  
relevantTechniques: 
id: 3cf46cb9-99d5-42ee-a43c-7bd88ea394a1
queryFrequency: 5m
status: Available
version: 1.0.1
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: DestinationIP
    identifier: Address
- entityType: IP
  fieldMappings:
  - columnName: SourceIP
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: DestinationHostName
    identifier: FullName
- entityType: Host
  fieldMappings:
  - columnName: SourceHostName
    identifier: FullName
- entityType: URL
  fieldMappings:
  - columnName: RequestURL
    identifier: Url

ARM