Critical or High Severity Detections by User

Back


Id	4465ebde-b381-45f7-ad08-7d818070a11c
Rulename	Critical or High Severity Detections by User
Description	Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user
Severity	High
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml
Version	1.0.4
Arm template	4465ebde-b381-45f7-ad08-7d818070a11c.json

KQL

let timeframe = 1h;
let threshold = 15; // update threshold value based on organization's preference
let NoteableEvents = CrowdStrikeFalconEventStream
| where TimeGenerated > ago(timeframe)
| where EventType == "DetectionSummaryEvent"
| where Severity in ("Critical", "High")
| summarize Total = count() by DstUserName
| where Total > threshold;
CrowdStrikeFalconEventStream
| where TimeGenerated > ago(timeframe)
| where EventType == "DetectionSummaryEvent"
| where Severity in ("Critical", "High")
| join kind=inner (NoteableEvents) on DstUserName
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, FileName, FileHash, Message
| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = "MD5"

YAML

status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml
query: |
  let timeframe = 1h;
  let threshold = 15; // update threshold value based on organization's preference
  let NoteableEvents = CrowdStrikeFalconEventStream
  | where TimeGenerated > ago(timeframe)
  | where EventType == "DetectionSummaryEvent"
  | where Severity in ("Critical", "High")
  | summarize Total = count() by DstUserName
  | where Total > threshold;
  CrowdStrikeFalconEventStream
  | where TimeGenerated > ago(timeframe)
  | where EventType == "DetectionSummaryEvent"
  | where Severity in ("Critical", "High")
  | join kind=inner (NoteableEvents) on DstUserName
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, FileName, FileHash, Message
  | extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = "MD5"  
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
tactics: []
name: Critical or High Severity Detections by User
relevantTechniques: []
severity: High
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: FullName
    columnName: HostCustomEntity
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
- fieldMappings:
  - identifier: Algorithm
    columnName: FileHashAlgo
  - identifier: Value
    columnName: FileHashCustomEntity
  entityType: FileHash
kind: Scheduled
queryFrequency: 1h
description: |
    'Creates an incident when a large number of Critical/High severity CrowdStrike Falcon sensor detections is triggered by a single user'
triggerThreshold: 0
triggerOperator: gt
version: 1.0.4
queryPeriod: 1h
id: 4465ebde-b381-45f7-ad08-7d818070a11c

ARM