D3 Smart SOAR - High or critical severity incident detected

Back


Id	48ef0be4-8240-4a03-bbb9-320b562d6ce4
Rulename	D3 Smart SOAR - High or critical severity incident detected
Description	Identifies when a D3 Smart SOAR incident with High or Critical severity is ingested. This helps security teams prioritize response to the most impactful incidents reported by D3 Smart SOAR.
Severity	High
Tactics	Impact
Techniques	T1499
Required data connectors	D3SOARConnectorDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/D3SmartSOAR/Analytic Rules/D3SmartSOAR-HighOrCriticalSeverityIncident.yaml
Version	1.0.0
Arm template	48ef0be4-8240-4a03-bbb9-320b562d6ce4.json

KQL

D3SOARIncidents_CL
| where TimeGenerated > ago(1h)
| where IncidentSeverity in ("High", "Critical")
| project
    TimeGenerated,
    IncidentNumber,
    IncidentTitle,
    IncidentSeverity,
    IncidentStatus,
    IncidentType,
    IncidentPriority,
    IncidentOwner,
    IncidentCreator,
    IncidentDescription,
    IncidentStage

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/D3SmartSOAR/Analytic Rules/D3SmartSOAR-HighOrCriticalSeverityIncident.yaml
queryPeriod: 1h
description: |
    Identifies when a D3 Smart SOAR incident with High or Critical severity is ingested. This helps security teams prioritize response to the most impactful incidents reported by D3 Smart SOAR.
triggerThreshold: 0
name: D3 Smart SOAR - High or critical severity incident detected
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: IncidentOwner
kind: Scheduled
requiredDataConnectors:
- connectorId: D3SOARConnectorDefinition
  dataTypes:
  - D3SOARIncidents_CL
queryFrequency: 1h
tactics:
- Impact
id: 48ef0be4-8240-4a03-bbb9-320b562d6ce4
status: Available
version: 1.0.0
query: |
  D3SOARIncidents_CL
  | where TimeGenerated > ago(1h)
  | where IncidentSeverity in ("High", "Critical")
  | project
      TimeGenerated,
      IncidentNumber,
      IncidentTitle,
      IncidentSeverity,
      IncidentStatus,
      IncidentType,
      IncidentPriority,
      IncidentOwner,
      IncidentCreator,
      IncidentDescription,
      IncidentStage  
severity: High
relevantTechniques:
- T1499

ARM