D3 Smart SOAR - High or critical severity incident detected

Back


Id	48ef0be4-8240-4a03-bbb9-320b562d6ce4
Rulename	D3 Smart SOAR - High or critical severity incident detected
Description	Identifies when a D3 Smart SOAR incident with High or Critical severity is ingested. This helps security teams prioritize response to the most impactful incidents reported by D3 Smart SOAR.
Severity	High
Tactics	Impact
Techniques	T1499
Required data connectors	D3SOARConnectorDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/D3SmartSOAR/Analytic Rules/D3SmartSOAR-HighOrCriticalSeverityIncident.yaml
Version	1.0.0
Arm template	48ef0be4-8240-4a03-bbb9-320b562d6ce4.json

KQL

D3SOARIncidents_CL
| where TimeGenerated > ago(1h)
| where IncidentSeverity in ("High", "Critical")
| project
    TimeGenerated,
    IncidentNumber,
    IncidentTitle,
    IncidentSeverity,
    IncidentStatus,
    IncidentType,
    IncidentPriority,
    IncidentOwner,
    IncidentCreator,
    IncidentDescription,
    IncidentStage

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: IncidentOwner
tactics:
- Impact
requiredDataConnectors:
- dataTypes:
  - D3SOARIncidents_CL
  connectorId: D3SOARConnectorDefinition
id: 48ef0be4-8240-4a03-bbb9-320b562d6ce4
severity: High
status: Available
query: |
  D3SOARIncidents_CL
  | where TimeGenerated > ago(1h)
  | where IncidentSeverity in ("High", "Critical")
  | project
      TimeGenerated,
      IncidentNumber,
      IncidentTitle,
      IncidentSeverity,
      IncidentStatus,
      IncidentType,
      IncidentPriority,
      IncidentOwner,
      IncidentCreator,
      IncidentDescription,
      IncidentStage  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/D3SmartSOAR/Analytic Rules/D3SmartSOAR-HighOrCriticalSeverityIncident.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.0
name: D3 Smart SOAR - High or critical severity incident detected
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1499
description: |
    Identifies when a D3 Smart SOAR incident with High or Critical severity is ingested. This helps security teams prioritize response to the most impactful incidents reported by D3 Smart SOAR.
triggerOperator: gt

ARM