Critical Severity Incident | Microsoft Sentinel Analytic Rules

Back


Id	4f1c9e6e-8b6b-4d2a-9f3e-123456789abc
Rulename	Critical Severity Incident
Description	Triggers an incident for every Morphisec alert whose attacks severity is critical.
Severity	High
Tactics	Execution DefenseEvasion
Techniques	T1059 T1204
Required data connectors	MorphisecCCF
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Morphisec/Analytic%20Rules/MorphisecCriticalSeverityIncident.yaml
Version	1.0.0
Arm template	4f1c9e6e-8b6b-4d2a-9f3e-123456789abc.json

KQL

MorphisecAlerts_CL
| where threatMessageArrivalTime >= ago(10m)
| where attackSeverity == "CRITICAL"
| summarize arg_max(threatMessageArrivalTime, *) by id

YAML

suppressionDuration: 5h
name: Critical Severity Incident
suppressionEnabled: false
triggerOperator: gt
query: |
  MorphisecAlerts_CL
  | where threatMessageArrivalTime >= ago(10m)
  | where attackSeverity == "CRITICAL"
  | summarize arg_max(threatMessageArrivalTime, *) by id
queryFrequency: 10m
description: |
  'Triggers an incident for every Morphisec alert whose attacks severity is critical.'
id: 4f1c9e6e-8b6b-4d2a-9f3e-123456789abc
triggerThreshold: 0
queryPeriod: 10m
version: 1.0.0
kind: Scheduled
status: Available
eventGroupingSettings:
  aggregationKind: SingleAlert
severity: High
requiredDataConnectors:
- connectorId: MorphisecCCF
  dataTypes:
  - Morphisec
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Morphisec/Analytic%20Rules/MorphisecCriticalSeverityIncident.yaml
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 5h
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
  createIncident: true
alertDetailsOverride:
  alertDisplayNameFormat: 'Critical alert detected: {{threatSubType}}'
relevantTechniques:
- T1059
- T1204
tactics:
- Execution
- DefenseEvasion
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: hostname
  entityType: Host
- fieldMappings:
  - identifier: CommandLine
    columnName: processCommandLine
  entityType: Process

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4f1c9e6e-8b6b-4d2a-9f3e-123456789abc')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4f1c9e6e-8b6b-4d2a-9f3e-123456789abc')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDisplayNameFormat": "Critical alert detected: {{threatSubType}}"
        },
        "alertRuleTemplateName": "4f1c9e6e-8b6b-4d2a-9f3e-123456789abc",
        "customDetails": null,
        "description": "'Triggers an incident for every Morphisec alert whose attacks severity is critical.'\n",
        "displayName": "Critical Severity Incident",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "hostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Process",
            "fieldMappings": [
              {
                "columnName": "processCommandLine",
                "identifier": "CommandLine"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Morphisec/Analytic%20Rules/MorphisecCriticalSeverityIncident.yaml",
        "query": "MorphisecAlerts_CL\n| where threatMessageArrivalTime >= ago(10m)\n| where attackSeverity == \"CRITICAL\"\n| summarize arg_max(threatMessageArrivalTime, *) by id\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution"
        ],
        "techniques": [
          "T1059",
          "T1204"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}