D3 Smart SOAR - High or critical severity incident detected

Back


Id	48ef0be4-8240-4a03-bbb9-320b562d6ce4
Rulename	D3 Smart SOAR - High or critical severity incident detected
Description	Identifies when a D3 Smart SOAR incident with High or Critical severity is ingested. This helps security teams prioritize response to the most impactful incidents reported by D3 Smart SOAR.
Severity	High
Tactics	Impact
Techniques	T1499
Required data connectors	D3SOARConnectorDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/D3SmartSOAR/Analytic Rules/D3SmartSOAR-HighOrCriticalSeverityIncident.yaml
Version	1.0.0
Arm template	48ef0be4-8240-4a03-bbb9-320b562d6ce4.json

KQL

D3SOARIncidents_CL
| where TimeGenerated > ago(1h)
| where IncidentSeverity in ("High", "Critical")
| project
    TimeGenerated,
    IncidentNumber,
    IncidentTitle,
    IncidentSeverity,
    IncidentStatus,
    IncidentType,
    IncidentPriority,
    IncidentOwner,
    IncidentCreator,
    IncidentDescription,
    IncidentStage

YAML

entityMappings:
- fieldMappings:
  - columnName: IncidentOwner
    identifier: Name
  entityType: Account
triggerOperator: gt
tactics:
- Impact
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/D3SmartSOAR/Analytic Rules/D3SmartSOAR-HighOrCriticalSeverityIncident.yaml
version: 1.0.0
query: |
  D3SOARIncidents_CL
  | where TimeGenerated > ago(1h)
  | where IncidentSeverity in ("High", "Critical")
  | project
      TimeGenerated,
      IncidentNumber,
      IncidentTitle,
      IncidentSeverity,
      IncidentStatus,
      IncidentType,
      IncidentPriority,
      IncidentOwner,
      IncidentCreator,
      IncidentDescription,
      IncidentStage  
triggerThreshold: 0
relevantTechniques:
- T1499
queryPeriod: 1h
status: Available
severity: High
kind: Scheduled
name: D3 Smart SOAR - High or critical severity incident detected
queryFrequency: 1h
id: 48ef0be4-8240-4a03-bbb9-320b562d6ce4
description: |
    Identifies when a D3 Smart SOAR incident with High or Critical severity is ingested. This helps security teams prioritize response to the most impactful incidents reported by D3 Smart SOAR.
requiredDataConnectors:
- dataTypes:
  - D3SOARIncidents_CL
  connectorId: D3SOARConnectorDefinition

ARM