Flow Logs Alerts for Prancer

Back


Id	59336232-1bbc-4f66-90dd-5ac3708e4405
Rulename	Flow Logs Alerts for Prancer
Description	High severity flow Log alerts found by Prancer.
Severity	High
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	PrancerLogData
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Flow_Logs_High_Severity.yaml
Version	1.0.3
Arm template	59336232-1bbc-4f66-90dd-5ac3708e4405.json

KQL

union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Network/networkWatchers/flowLogs'
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot 
| extend
    id = tostring(snapshot.id),
    structure = tostring(snapshot.structure),
    reference = tostring(snapshot.reference),
    source = tostring(snapshot.source),
    collection = tostring(snapshot.collection),
    type = tostring(snapshot.type),
    region = tostring(snapshot.region),
    resourceTypes = tostring(snapshot.resourceTypes),
    path = tostring(snapshot.path)

YAML

alertDetailsOverride:
  alertDynamicProperties:
  - value: data_data_remediation_description_s
    alertProperty: RemediationSteps
  alertSeverityColumnName: '{{data_data_severity_s}}'
  alertDescriptionFormat: '{{data_data_description_s}}'
  alertDisplayNameFormat: '{{data_data_message_s}}'
queryFrequency: 5h
relevantTechniques:
- T1595
customDetails: 
kind: Scheduled
tactics:
- Reconnaissance
query: |
  union prancer_CL
  | where deviceProduct_s == 'azure'
  | where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Network/networkWatchers/flowLogs'
  | where data_data_severity_s == 'High' and data_data_result_s == 'failed'
  | extend snapshot = parse_json(data_data_snapshots_s)
  | mv-expand snapshot 
  | extend
      id = tostring(snapshot.id),
      structure = tostring(snapshot.structure),
      reference = tostring(snapshot.reference),
      source = tostring(snapshot.source),
      collection = tostring(snapshot.collection),
      type = tostring(snapshot.type),
      region = tostring(snapshot.region),
      resourceTypes = tostring(snapshot.resourceTypes),
      path = tostring(snapshot.path)  
name: Flow Logs Alerts for Prancer
id: 59336232-1bbc-4f66-90dd-5ac3708e4405
queryPeriod: 5h
triggerOperator: gt
entityMappings:
- fieldMappings:
  - identifier: ResourceId
    columnName: path
  entityType: AzureResource
triggerThreshold: 0
severity: High
requiredDataConnectors:
- connectorId: PrancerLogData
  dataTypes:
  - prancer_CL
version: 1.0.3
status: Available
description: |
    'High severity flow Log alerts found by Prancer.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Flow_Logs_High_Severity.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert

ARM