Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Guardian- Content Access Control Blocked List Policy Violation Detection

Back
Id4c7f0b49-d972-4d26-81ab-36cbe43ac437
RulenameGuardian- Content Access Control Blocked List Policy Violation Detection
DescriptionThis alert creates an incident when Content Access Control Blocked List Policy Violation detected from the Guardian.
SeverityMedium
Required data connectorsBoschAIShield
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ContentAccessControlBlockedListVulDetection.yaml
Version1.0.0
Arm template4c7f0b49-d972-4d26-81ab-36cbe43ac437.json
Deploy To Azure
Guardian
| where PolicyViolatedControlFeature =~ 'Blocked List'
| where Severity =~ 'Medium'
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: SingleAlert
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'Blocked List'
  | where Severity =~ 'Medium'  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ContentAccessControlBlockedListVulDetection.yaml
name: Guardian- Content Access Control Blocked List Policy Violation Detection
version: 1.0.0
queryPeriod: 1h
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: NTDomain
    identifier: NTDomain
- entityType: IP
  fieldMappings:
  - columnName: SourceIP
    identifier: Address
requiredDataConnectors:
- connectorId: BoschAIShield
  dataTypes:
  - Guardian
relevantTechniques: []
tactics: []
description: |
    'This alert creates an incident when Content Access Control Blocked List Policy Violation detected from the Guardian.'
id: 4c7f0b49-d972-4d26-81ab-36cbe43ac437
status: Available
queryFrequency: 1h
triggerOperator: gt
alertDetailsOverride:
  alertSeverityColumnName: Severity
  alertTacticsColumnName: 
  alertDisplayNameFormat: Guardian- Content Access Control Blocked List Policy Violation detection
  alertDescriptionFormat: |
        This query detects Content Access Control Blocked List Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further
severity: Medium
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4c7f0b49-d972-4d26-81ab-36cbe43ac437')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4c7f0b49-d972-4d26-81ab-36cbe43ac437')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This query detects Content Access Control Blocked List Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\\n\\nPlease check the source for more information and investigate further\n",
          "alertDisplayNameFormat": "Guardian- Content Access Control Blocked List Policy Violation detection",
          "alertSeverityColumnName": "Severity",
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "4c7f0b49-d972-4d26-81ab-36cbe43ac437",
        "customDetails": null,
        "description": "'This alert creates an incident when Content Access Control Blocked List Policy Violation detected from the Guardian.'\n",
        "displayName": "Guardian- Content Access Control Blocked List Policy Violation Detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ContentAccessControlBlockedListVulDetection.yaml",
        "query": "Guardian\n| where PolicyViolatedControlFeature =~ 'Blocked List'\n| where Severity =~ 'Medium'\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}