Jamf Protect - Network Threats
Id | 44da53c3-f3b0-4b70-afff-f79275cb9442 |
Rulename | Jamf Protect - Network Threats |
Description | Creates an incident based based on Jamf Protect’s Network Threat Event Stream alerts. |
Severity | Informational |
Tactics | InitialAccess |
Required data connectors | JamfProtect |
Kind | NRT |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml |
Version | 1.0.3 |
Arm template | 44da53c3-f3b0-4b70-afff-f79275cb9442.json |
JamfProtect
| where EventProduct == "Jamf Protect - Threat Events Stream"
and EventResult == "Blocked"
and isnotempty(EventSeverity)
| extend Tactics = "Initial Access"
| extend Techniques = "T1566"
severity: Informational
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml
description: |
'Creates an incident based based on Jamf Protect's Network Threat Event Stream alerts.'
relevantTechniques:
customDetails:
Category: ThreatCategory
suppressionDuration: PT5H
requiredDataConnectors:
- dataTypes:
- jamfprotect_CL
connectorId: JamfProtect
alertDetailsOverride:
alertDescriptionFormat: A Network Threat has been {{EventResult}} on {{DvcHostname}}
alertDynamicProperties:
- value: EventReportUrl
alertProperty: AlertLink
- value: EventVendor
alertProperty: ProviderName
- value: EventProduct
alertProperty: ProductName
- value: EventResult
alertProperty: RemediationSteps
- value: Techniques
alertProperty: Techniques
alertSeverityColumnName: EventSeverity
alertDisplayNameFormat: Network Threat detected on {{DvcHostname}}
alertTacticsColumnName: Tactics
incidentConfiguration:
createIncident: true
groupingConfiguration:
reopenClosedIncident: false
matchingMethod: AllEntities
lookbackDuration: PT5H
enabled: false
tactics:
- InitialAccess
query: |
JamfProtect
| where EventProduct == "Jamf Protect - Threat Events Stream"
and EventResult == "Blocked"
and isnotempty(EventSeverity)
| extend Tactics = "Initial Access"
| extend Techniques = "T1566"
status: Available
kind: NRT
version: 1.0.3
id: 44da53c3-f3b0-4b70-afff-f79275cb9442
suppressionEnabled: false
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- fieldMappings:
- columnName: Hostname
identifier: HostName
- columnName: DvcOs
identifier: OSFamily
entityType: Host
- fieldMappings:
- columnName: DstIpAddr
identifier: Address
entityType: IP
- fieldMappings:
- columnName: SrcUsermail
identifier: AadUserId
- columnName: SrcUsername
identifier: FullName
entityType: Account
- fieldMappings:
- columnName: DnsQueryName
identifier: Url
entityType: URL
name: Jamf Protect - Network Threats
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/44da53c3-f3b0-4b70-afff-f79275cb9442')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/44da53c3-f3b0-4b70-afff-f79275cb9442')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "NRT",
"apiVersion": "2022-11-01-preview",
"properties": {
"displayName": "Jamf Protect - Network Threats",
"description": "'Creates an incident based based on Jamf Protect's Network Threat Event Stream alerts.'\n",
"severity": "Informational",
"enabled": true,
"query": "JamfProtect\n| where EventProduct == \"Jamf Protect - Threat Events Stream\"\n and EventResult == \"Blocked\"\n and isnotempty(EventSeverity)\n| extend Tactics = \"Initial Access\"\n| extend Techniques = \"T1566\"\n",
"suppressionDuration": "PT5H",
"suppressionEnabled": false,
"tactics": [
"InitialAccess"
],
"techniques": null,
"alertRuleTemplateName": "44da53c3-f3b0-4b70-afff-f79275cb9442",
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"reopenClosedIncident": false,
"matchingMethod": "AllEntities",
"lookbackDuration": "PT5H"
}
},
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"alertDetailsOverride": {
"alertDynamicProperties": [
{
"value": "EventReportUrl",
"alertProperty": "AlertLink"
},
{
"value": "EventVendor",
"alertProperty": "ProviderName"
},
{
"value": "EventProduct",
"alertProperty": "ProductName"
},
{
"value": "EventResult",
"alertProperty": "RemediationSteps"
},
{
"value": "Techniques",
"alertProperty": "Techniques"
}
],
"alertDisplayNameFormat": "Network Threat detected on {{DvcHostname}}",
"alertDescriptionFormat": "A Network Threat has been {{EventResult}} on {{DvcHostname}}",
"alertSeverityColumnName": "EventSeverity",
"alertTacticsColumnName": "Tactics"
},
"customDetails": {
"Category": "ThreatCategory"
},
"entityMappings": [
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Hostname",
"identifier": "HostName"
},
{
"columnName": "DvcOs",
"identifier": "OSFamily"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "DstIpAddr",
"identifier": "Address"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "SrcUsermail",
"identifier": "AadUserId"
},
{
"columnName": "SrcUsername",
"identifier": "FullName"
}
]
},
{
"entityType": "URL",
"fieldMappings": [
{
"columnName": "DnsQueryName",
"identifier": "Url"
}
]
}
],
"status": "Available",
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Jamf Protect/Analytic Rules/JamfProtectNetworkThreats.yaml",
"templateVersion": "1.0.3"
}
}
]
}