Dynatrace - Problem detection

Back


Id	415978ff-074e-4203-824a-b06153d77bf7
Rulename	Dynatrace - Problem detection
Description	Detect application & infrastructure problems in your environment
Severity	Informational
Tactics	DefenseEvasion Execution Impact InitialAccess LateralMovement Persistence PrivilegeEscalation
Required data connectors	DynatraceProblems
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/Dynatrace_ProblemDetection.yaml
Version	1.0.2
Arm template	415978ff-074e-4203-824a-b06153d77bf7.json

KQL

DynatraceProblems
| summarize  arg_max(StartTime, *) by ProblemId

YAML

eventGroupingSettings:
  aggregationKind: AlertPerResult
requiredDataConnectors:
- connectorId: DynatraceProblems
  dataTypes:
  - DynatraceProblems
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/Dynatrace_ProblemDetection.yaml
triggerThreshold: 0
status: Available
customDetails:
  SeverityLevel: SeverityLevel
  ImpactLevel: ImpactLevel
  ProblemIdentifier: ProblemId
  DisplayIdentifier: DisplayId
queryPeriod: 1d
requiredTechniques:
- T1140
- T1059
- T1565
- T1659
- T1210
- T1554
- T1548
name: Dynatrace - Problem detection
alertDetailsOverride:
  alertSeverityColumnName: Severity
  alertDisplayNameFormat: 'Dynatrace problem detected - {{DisplayId}} : {{Title}}'
  alertDescriptionFormat: |
        A application and/or infrastructure problem has been detected in your environment
queryFrequency: 1d
triggerOperator: gt
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
description: |
    'Detect application & infrastructure problems in your environment'
tactics:
- DefenseEvasion
- Execution
- Impact
- InitialAccess
- LateralMovement
- Persistence
- PrivilegeEscalation
severity: Informational
version: 1.0.2
query: |
  DynatraceProblems
  | summarize  arg_max(StartTime, *) by ProblemId  
id: 415978ff-074e-4203-824a-b06153d77bf7

ARM