JamfProtectThreatEvents
| where EventResult == "Blocked"
and isnotempty(EventSeverity)
| extend Tactics = "Initial Access"
| extend Techniques = "T1566"
query: |
JamfProtectThreatEvents
| where EventResult == "Blocked"
and isnotempty(EventSeverity)
| extend Tactics = "Initial Access"
| extend Techniques = "T1566"
entityMappings:
- fieldMappings:
- identifier: HostName
columnName: Hostname
- identifier: OSFamily
columnName: DvcOs
entityType: Host
- fieldMappings:
- identifier: Address
columnName: DstIpAddr
entityType: IP
- fieldMappings:
- identifier: AadUserId
columnName: SrcUsermail
- identifier: FullName
columnName: SrcUsername
entityType: Account
- fieldMappings:
- identifier: Url
columnName: DnsQueryName
entityType: URL
alertDetailsOverride:
alertDescriptionFormat: A Network Threat has been {{EventResult}} on {{DvcHostname}}
alertDisplayNameFormat: Network Threat detected on {{DvcHostname}}
alertTacticsColumnName: Tactics
alertDynamicProperties:
- value: EventReportUrl
alertProperty: AlertLink
- value: EventVendor
alertProperty: ProviderName
- value: EventProduct
alertProperty: ProductName
- value: EventResult
alertProperty: RemediationSteps
- value: Techniques
alertProperty: Techniques
alertSeverityColumnName: EventSeverity
incidentConfiguration:
groupingConfiguration:
reopenClosedIncident: false
enabled: false
lookbackDuration: PT5H
matchingMethod: AllEntities
createIncident: true
description: |
'Creates an incident based based on Jamf Protect's Network Threat Event Stream alerts.'
suppressionDuration: PT5H
tactics:
- InitialAccess
severity: Informational
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml
kind: NRT
name: Jamf Protect - Network Threats
eventGroupingSettings:
aggregationKind: AlertPerResult
status: Available
suppressionEnabled: false
id: 44da53c3-f3b0-4b70-afff-f79275cb9442
requiredDataConnectors:
- connectorId: JamfProtect
dataTypes:
- jamfprotect_CL
relevantTechniques:
- T1133
customDetails:
Category: ThreatCategory
version: 1.0.5
