CiscoISE - Device PostureStatus changed to non-compliant

Back


Id	548a2eda-d3eb-46cc-8d4b-1601551629e4
Rulename	CiscoISE - Device PostureStatus changed to non-compliant
Description	Detects when device changes PostureStatus from “Compliant”.
Severity	Medium
Tactics	PrivilegeEscalation Persistence
Techniques	T1098
Required data connectors	CiscoISE SyslogAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEDevicePostureStatusChanged.yaml
Version	1.0.2
Arm template	548a2eda-d3eb-46cc-8d4b-1601551629e4.json

KQL

let lbtime_48h = 48h;
let lbtime_24h = 24h;
let lbtime_now = now();
let compliantIPs = CiscoISEEvent
| where TimeGenerated between (ago(lbtime_48h) .. ago(lbtime_24h))
| where PostureStatus == 'Compliant'
| summarize makelist(DstIpAddr)
;
CiscoISEEvent
| where TimeGenerated between (ago(lbtime_24h) .. lbtime_now)
| where PostureStatus != 'Compliant'
| where DstIpAddr in (compliantIPs)
| project DstIpAddr
| extend IPCustomEntity = DstIpAddr

YAML

kind: Scheduled
relevantTechniques:
- T1098
description: |
    'Detects when device changes PostureStatus from "Compliant".'
queryPeriod: 15m
queryFrequency: 15m
tactics:
- PrivilegeEscalation
- Persistence
name: CiscoISE - Device PostureStatus changed to non-compliant
requiredDataConnectors:
- connectorId: CiscoISE
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  datatypes:
  - Syslog
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
triggerThreshold: 0
version: 1.0.2
id: 548a2eda-d3eb-46cc-8d4b-1601551629e4
query: |
  let lbtime_48h = 48h;
  let lbtime_24h = 24h;
  let lbtime_now = now();
  let compliantIPs = CiscoISEEvent
  | where TimeGenerated between (ago(lbtime_48h) .. ago(lbtime_24h))
  | where PostureStatus == 'Compliant'
  | summarize makelist(DstIpAddr)
  ;
  CiscoISEEvent
  | where TimeGenerated between (ago(lbtime_24h) .. lbtime_now)
  | where PostureStatus != 'Compliant'
  | where DstIpAddr in (compliantIPs)
  | project DstIpAddr
  | extend IPCustomEntity = DstIpAddr  
status: Available
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEDevicePostureStatusChanged.yaml
severity: Medium

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/548a2eda-d3eb-46cc-8d4b-1601551629e4')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/548a2eda-d3eb-46cc-8d4b-1601551629e4')]",
      "properties": {
        "alertRuleTemplateName": "548a2eda-d3eb-46cc-8d4b-1601551629e4",
        "customDetails": null,
        "description": "'Detects when device changes PostureStatus from \"Compliant\".'\n",
        "displayName": "CiscoISE - Device PostureStatus changed to non-compliant",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cisco ISE/Analytic Rules/CiscoISEDevicePostureStatusChanged.yaml",
        "query": "let lbtime_48h = 48h;\nlet lbtime_24h = 24h;\nlet lbtime_now = now();\nlet compliantIPs = CiscoISEEvent\n| where TimeGenerated between (ago(lbtime_48h) .. ago(lbtime_24h))\n| where PostureStatus == 'Compliant'\n| summarize makelist(DstIpAddr)\n;\nCiscoISEEvent\n| where TimeGenerated between (ago(lbtime_24h) .. lbtime_now)\n| where PostureStatus != 'Compliant'\n| where DstIpAddr in (compliantIPs)\n| project DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1098"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}