Storage Accounts Alerts From Prancer

Back


Id	4adf2b5d-6b88-4b96-8cc2-a3c7fbbee10b
Rulename	Storage Accounts Alerts From Prancer
Description	High severity storage account alerts found by Prancer.
Severity	High
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	PrancerLogData
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Storage_Accounts_High_Severity.yaml
Version	1.0.2
Arm template	4adf2b5d-6b88-4b96-8cc2-a3c7fbbee10b.json

KQL

union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Storage/storageAccounts'
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot 
| extend
    id = tostring(snapshot.id),
    structure = tostring(snapshot.structure),
    reference = tostring(snapshot.reference),
    source = tostring(snapshot.source),
    collection = tostring(snapshot.collection),
    type = tostring(snapshot.type),
    region = tostring(snapshot.region),
    resourceTypes = tostring(snapshot.resourceTypes),
    path = tostring(snapshot.path)

YAML

entityMappings:
- entityType: AzureResource
  fieldMappings:
  - identifier: ResourceId
    columnName: path
tactics:
- Reconnaissance
requiredDataConnectors:
- dataTypes:
  - prancer_CL
  connectorId: PrancerLogData
alertDetailsOverride:
  alertDisplayNameFormat: '{{data_data_message_s}}'
  alertDescriptionFormat: '{{data_data_description_s}}'
  alertSeverityColumnName: '{{data_data_severity_s}}'
  alertDynamicProperties:
  - value: data_data_remediation_description_s
    alertProperty: RemediationSteps
id: 4adf2b5d-6b88-4b96-8cc2-a3c7fbbee10b
severity: High
status: Available
customDetails: 
query: |
  union prancer_CL
  | where deviceProduct_s == 'azure'
  | where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Storage/storageAccounts'
  | where data_data_severity_s == 'High' and data_data_result_s == 'failed'
  | extend snapshot = parse_json(data_data_snapshots_s)
  | mv-expand snapshot 
  | extend
      id = tostring(snapshot.id),
      structure = tostring(snapshot.structure),
      reference = tostring(snapshot.reference),
      source = tostring(snapshot.source),
      collection = tostring(snapshot.collection),
      type = tostring(snapshot.type),
      region = tostring(snapshot.region),
      resourceTypes = tostring(snapshot.resourceTypes),
      path = tostring(snapshot.path)  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Storage_Accounts_High_Severity.yaml
kind: Scheduled
queryPeriod: 5h
version: 1.0.2
name: Storage Accounts Alerts From Prancer
queryFrequency: 5h
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1595
description: |
    'High severity storage account alerts found by Prancer.'
triggerThreshold: 0
triggerOperator: gt

ARM