Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Guardian- Content Access Control Blocked List Policy Violation Detection

Back
Id4c7f0b49-d972-4d26-81ab-36cbe43ac437
RulenameGuardian- Content Access Control Blocked List Policy Violation Detection
DescriptionThis alert creates an incident when Content Access Control Blocked List Policy Violation detected from the Guardian.
SeverityMedium
Required data connectorsBoschAIShield
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ContentAccessControlBlockedListVulDetection.yaml
Version1.0.0
Arm template4c7f0b49-d972-4d26-81ab-36cbe43ac437.json
Deploy To Azure
Guardian
| where PolicyViolatedControlFeature =~ 'Blocked List'
| where Severity =~ 'Medium'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ContentAccessControlBlockedListVulDetection.yaml
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'Blocked List'
  | where Severity =~ 'Medium'  
description: |
    'This alert creates an incident when Content Access Control Blocked List Policy Violation detected from the Guardian.'
severity: Medium
requiredDataConnectors:
- dataTypes:
  - Guardian
  connectorId: BoschAIShield
eventGroupingSettings:
  aggregationKind: SingleAlert
name: Guardian- Content Access Control Blocked List Policy Violation Detection
triggerThreshold: 0
version: 1.0.0
tactics: []
alertDetailsOverride:
  alertTacticsColumnName: 
  alertDescriptionFormat: |
        This query detects Content Access Control Blocked List Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further
  alertDisplayNameFormat: Guardian- Content Access Control Blocked List Policy Violation detection
  alertSeverityColumnName: Severity
relevantTechniques: []
triggerOperator: gt
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: NTDomain
    identifier: NTDomain
- entityType: IP
  fieldMappings:
  - columnName: SourceIP
    identifier: Address
id: 4c7f0b49-d972-4d26-81ab-36cbe43ac437
status: Available
kind: Scheduled
queryFrequency: 1h
queryPeriod: 1h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4c7f0b49-d972-4d26-81ab-36cbe43ac437')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4c7f0b49-d972-4d26-81ab-36cbe43ac437')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This query detects Content Access Control Blocked List Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\\n\\nPlease check the source for more information and investigate further\n",
          "alertDisplayNameFormat": "Guardian- Content Access Control Blocked List Policy Violation detection",
          "alertSeverityColumnName": "Severity",
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "4c7f0b49-d972-4d26-81ab-36cbe43ac437",
        "customDetails": null,
        "description": "'This alert creates an incident when Content Access Control Blocked List Policy Violation detected from the Guardian.'\n",
        "displayName": "Guardian- Content Access Control Blocked List Policy Violation Detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/ContentAccessControlBlockedListVulDetection.yaml",
        "query": "Guardian\n| where PolicyViolatedControlFeature =~ 'Blocked List'\n| where Severity =~ 'Medium'\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}