{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4720d7a5-6845-4ce4-aa45-79334e1a1176')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4720d7a5-6845-4ce4-aa45-79334e1a1176')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Details: {{ThreatDocUrl}}",
          "alertDisplayNameFormat": "{{Subject}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "ThreatDocUrl"
            },
            {
              "alertProperty": "Techniques",
              "value": "Techniques"
            }
          ],
          "alertSeverityColumnName": "AlertSeverity",
          "alertTacticsColumnName": "Tactics"
        },
        "alertRuleTemplateName": "4720d7a5-6845-4ce4-aa45-79334e1a1176",
        "contentId": "CayosoftGuardianMainAlerts",
        "customDetails": {
          "Categories": "Categories",
          "CreatedDateTime": "CreatedDateTime",
          "Evidence": "Evidence",
          "RemediationComplex": "RemediationComplexity",
          "TargetName": "TargetObjectName",
          "TargetType": "TargetObjectType",
          "ThreatDocUrl": "ThreatDocUrl",
          "ThreatId": "ThreatId",
          "Where": "TargetLocation"
        },
        "description": "Creates Microsoft Sentinel incidents for identity and infrastructure security threats reported by Cayosoft Guardian across on-premises Active Directory and Microsoft Entra ID. This includes threats related to accounts, service accounts, computers, security groups, and trusted domains. Incident severity is determined dynamically based on the severity of the detected threat.\n\nThis rule complements the Cloud Application Security Threats rule, which covers cloud application and service principal threat alerts not included in this rule.\n\nAlerts with the same Cayosoft ThreatId are grouped into a single incident within a 1-day lookback window. Each alert includes a link to the Cayosoft Threat Directory for guidance on remediation.\n",
        "displayName": "Cayosoft Guardian - Core Identity and Infrastructure Threats",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "TargetAccountAadUserId",
                "identifier": "AadUserId"
              },
              {
                "columnName": "TargetAccountName",
                "identifier": "Name"
              },
              {
                "columnName": "TargetAccountObjectGuid",
                "identifier": "ObjectGuid"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "TargetHostName",
                "identifier": "HostName"
              },
              {
                "columnName": "TargetHostDomain",
                "identifier": "NTDomain"
              },
              {
                "columnName": "TargetHostAzureID",
                "identifier": "AzureID"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "TargetGroupDistinguishedName",
                "identifier": "DistinguishedName"
              },
              {
                "columnName": "TargetGroupObjectGuid",
                "identifier": "ObjectGuid"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "TargetDNSName",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "ThreatId"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cayosoft%20Guardian/Analytic%20Rules/CayosoftGuardian-MainRule.yaml",
        "query": "// ATTENTION: ruleFrequency must match the \"queryFrequency\" value in the rule's scheduling settings!\n// ATTENTION: lookbackPeriod must match the \"queryPeriod\" value in the rule's scheduling settings!\n// If you change one, change both, in every location, or you will reintroduce duplicate alerts.\n// Pattern reference: https://learn.microsoft.com/en-us/azure/sentinel/ingestion-delay\nlet ruleFrequency = 1h;\nlet lookbackPeriod = 1d;\nlet window_end = bin(now(), ruleFrequency);      \nlet window_start = window_end - ruleFrequency;   \nCayosoftThreatAlerts_CL\n| where TimeGenerated >= ago(lookbackPeriod)\n| where ingestion_time() > window_start and ingestion_time() <= window_end\n| extend ParsedCategories = todynamic(Categories)\n| extend TargetObjectTypeNormalized = tostring(TargetObjectType)\n| extend TargetLocationNormalized = tostring(TargetLocation)\n| mv-apply Cat = ParsedCategories on (\n    summarize Values = make_list(tostring(Cat.value)) by Key = iff(tostring(Cat.name) startswith 'MITRE ATT', 'MITRE ATT&CK', tostring(Cat.name))\n| summarize CleanCategories = make_bag(pack(Key, strcat_array(Values, ', ')))\n    )\n| extend Tactics = iff(isnotempty(CleanCategories['Attack tactics']), split(replace_string(tostring(CleanCategories['Attack tactics']), ' ', ''), ','), dynamic([]))\n| extend Techniques = iff(isnotempty(CleanCategories['MITRE ATT&CK']), extract_all(@\"(T\\d{4})\", tostring(CleanCategories['MITRE ATT&CK'])), dynamic([]))\n| extend ExtractedDomain = tostring(split(TargetLocationNormalized, '/')[0])\n| extend IsEntra = TargetObjectTypeNormalized startswith 'microsoft.graph'\n| extend IsAD = TargetObjectTypeNormalized startswith 'microsoft.ad' or TargetObjectTypeNormalized has 'ServiceAccount'\n| extend IsGMSA = TargetObjectTypeNormalized contains 'ManagedServiceAccount'\n| extend ParsedUser = case(\n    TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'ServiceAccount' or TargetObjectTypeNormalized has 'inetOrgPerson', TargetObjectName,\n    extract(\"member\\\\s+'([^']+)'\", 1, Subject)\n    )\n| extend TargetAccountAadUserId = iff(IsEntra and TargetObjectTypeNormalized has 'user', TargetObjectId, dynamic(null))\n| extend TargetAccountName = case(\n    IsEntra and TargetObjectTypeNormalized has 'user', iff(ParsedUser contains '@', tostring(split(ParsedUser, '@')[0]), ParsedUser),\n    IsAD and (TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'foreignSecurityPrincipal' or IsGMSA), TargetObjectName,\n    IsAD and TargetObjectTypeNormalized has 'directoryObject', TargetObjectName,\n    isnotempty(ParsedUser), iff(ParsedUser contains '@', tostring(split(ParsedUser, '@')[0]), ParsedUser),\n    dynamic(null)\n    )\n| extend TargetAccountObjectGuid = iff(IsAD and (TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'foreignSecurityPrincipal' or IsGMSA), TargetObjectId, dynamic(null))\n| extend TargetHostName = iff(TargetObjectTypeNormalized has 'computer' or TargetObjectTypeNormalized has 'device', TargetObjectName, dynamic(null))\n| extend TargetHostDomain = iff(IsAD and TargetObjectTypeNormalized has 'computer', ExtractedDomain, dynamic(null))\n| extend TargetHostAzureID = iff(IsEntra and TargetObjectTypeNormalized has 'device', TargetObjectId, dynamic(null))\n| extend RawPath = iff(TargetLocationNormalized contains '/', substring(TargetLocationNormalized, indexof(TargetLocationNormalized, '/') + 1), '')\n// Convert domain\n| extend DomainDN = strcat('DC=', replace_string(ExtractedDomain, '.', ',DC='))\n// Smart path processing\n| extend PathDN = case(\n    isempty(RawPath), '',\n    RawPath has_any ('Builtin', 'Users', 'Computers', 'ForeignSecurityPrincipals', 'Managed Service Accounts'), strcat('CN=', replace_string(RawPath, '/', ',CN=')),\n    strcat('OU=', replace_string(RawPath, '/', ',OU='))\n)\n// Assemble the final DistinguishedName and Name for the group\n| extend TargetGroupName = iff(TargetObjectTypeNormalized has 'group', TargetObjectName, dynamic(null))\n| extend TargetGroupDistinguishedName = iff(\n    TargetObjectTypeNormalized has 'group', \n    strcat('CN=', TargetObjectName, iff(isnotempty(PathDN), strcat(',', PathDN), ''), ',', DomainDN), \n    dynamic(null)\n)\n| extend TargetGroupObjectGuid = iff(TargetObjectTypeNormalized has 'group', TargetObjectId, dynamic(null))\n| extend TargetDNSName = case(\n    IsAD and TargetObjectTypeNormalized has 'trustedDomain', TargetObjectName,\n    isnotempty(TargetLocationNormalized), ExtractedDomain,\n    dynamic(null)\n    )\n| extend ThreatDocUrl = tolower( strcat('https://www.cayosoft.com/threat-directory/', ThreatId, '/'))\n| extend AlertSeverity = case(\n    Severity == 'high', 'High',\n    Severity == 'medium', 'Medium',\n    Severity == 'low', 'Low',\n    Severity == 'informational', 'Informational',\n    'Informational'\n    )\n| project-away Categories, ParsedCategories\n| project-rename Categories = CleanCategories\n| where not(IsEntra and (TargetObjectType has 'application' or TargetObjectType has 'servicePrincipal'))\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}