Create Incidents from IronDefense

Back


Id	3cf46cb9-99d5-42ee-a43c-7bd88ea394a1
Rulename	Create Incidents from IronDefense
Description	Creates incidents based on behavioral detections from IronDefense.
Severity	Medium
Required data connectors	IronNetIronDefense
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml
Version	1.0.1
Arm template	3cf46cb9-99d5-42ee-a43c-7bd88ea394a1.json

KQL

CommonSecurityLog
| where DeviceProduct == "IronDefense"
| summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
| extend Category = coalesce(column_ifexists("DeviceEventCategory",""),extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions))	
| extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
| extend AlertDescription = strcat(Category, ': ', Subcategory)
| extend Status = tostring(DeviceCustomString2)
| extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))

YAML

entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: DestinationIP
  entityType: IP
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
- fieldMappings:
  - identifier: FullName
    columnName: DestinationHostName
  entityType: Host
- fieldMappings:
  - identifier: FullName
    columnName: SourceHostName
  entityType: Host
- fieldMappings:
  - identifier: Url
    columnName: RequestURL
  entityType: URL
version: 1.0.1
severity: Medium
relevantTechniques: 
tactics: 
id: 3cf46cb9-99d5-42ee-a43c-7bd88ea394a1
alertDetailsOverride:
  alertDisplayNameFormat: |
        {{Category}}: {{Subcategory}} ({{DeviceCustomString4}})
  alertSeverityColumnName: LogSeverity
  alertDescriptionFormat: |
        IronDefense detected suspicious activity on {{TimeGenerated}} and categorized it as "{{AlertDescription}}".  View full details in IronVue: {{IronVueUrl}}
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: IronNetIronDefense
name: Create Incidents from IronDefense
kind: Scheduled
queryFrequency: 5m
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IronNet IronDefense/Analytic Rules/IronDefense_Detection_Query.yaml
query: |
  CommonSecurityLog
  | where DeviceProduct == "IronDefense"
  | summarize arg_max(TimeGenerated, *) by DeviceCustomString4, DeviceCustomString2
  | extend Category = coalesce(column_ifexists("DeviceEventCategory",""),extract(@'cat=([^;]+)(\;|$)', 1, AdditionalExtensions))	
  | extend Subcategory = extract(@'subcat=([^;]+)(\;|$)', 1, AdditionalExtensions)
  | extend AlertDescription = strcat(Category, ': ', Subcategory)
  | extend Status = tostring(DeviceCustomString2)
  | extend IronVueUrl = replace(@'\\', @'', tostring(DeviceCustomString3))  
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryPeriod: 5m
status: Available
triggerOperator: gt
description: |
    'Creates incidents based on behavioral detections from IronDefense.'
customDetails:
  AnalystSeverity: DeviceCustomString1
  AnalystRating: LogSeverity
  IronDefenseStatus: Status
  IronDefenseAlertId: DeviceCustomString4
  IronVueUrl: IronVueUrl
  AlertCreatedTime: TimeGenerated

ARM