Create Incident for Data Security Violation events for DSPM license users

Back


Id	5b70b78e-397c-474c-a556-f6c37fccbb18
Rulename	Create Incident for Data Security Violation events for DSPM license users
Description	Creates an incident for Data Security Violation events for DSPM license users.
Severity	Medium
Tactics	Exfiltration
Techniques	T1567
Required data connectors	RubrikSecurityCloudAzureFunctions
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RubrikSecurityCloud/Analytic%20Rules/RubrikDataSecurityViolation.yaml
Version	1.0.0
Arm template	5b70b78e-397c-474c-a556-f6c37fccbb18.json

KQL

Rubrik_Violation_Data_CL
| where class_s == "SecurityViolation" and custom_details_eventName_s in ("CriticalSeverityDataViolationDetected",
"CriticalSeverityDataViolationReOpen",
"HighSeverityDataViolationDetected",
"HighSeverityDataViolationReOpen",
"LowOrMediumSeverityDataViolationDetected",
"LowOrMediumSeverityDataViolationReOpen")
| extend NewSeverity = case(severity_s=="info", "Low",
                            severity_s=="warning", "Medium",
                            severity_s=="critical", "High",
                            "Informational"),
         ObjectId = iff(isnotempty(custom_details_objectId_s), custom_details_objectId_s, tostring(custom_details_objectId_g)),
         ViolationId = iff(isnotempty(custom_details_seriesId_s), custom_details_seriesId_s, tostring(custom_details_seriesId_g))

YAML

queryFrequency: 5m
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: Selected
    lookbackDuration: P7D
    enabled: true
    groupByCustomDetails:
    - ViolationId
triggerThreshold: 0
triggerOperator: gt
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RubrikSecurityCloud/Analytic%20Rules/RubrikDataSecurityViolation.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertSeverityColumnName: NewSeverity
  alertDisplayNameFormat: '{{class_s}} event occurred for object {{custom_details_objectName_s}} with type {{custom_details_objectType_s}}'
  alertDescriptionFormat: '{{summary_s}}'
query: |
  Rubrik_Violation_Data_CL
  | where class_s == "SecurityViolation" and custom_details_eventName_s in ("CriticalSeverityDataViolationDetected",
  "CriticalSeverityDataViolationReOpen",
  "HighSeverityDataViolationDetected",
  "HighSeverityDataViolationReOpen",
  "LowOrMediumSeverityDataViolationDetected",
  "LowOrMediumSeverityDataViolationReOpen")
  | extend NewSeverity = case(severity_s=="info", "Low",
                              severity_s=="warning", "Medium",
                              severity_s=="critical", "High",
                              "Informational"),
           ObjectId = iff(isnotempty(custom_details_objectId_s), custom_details_objectId_s, tostring(custom_details_objectId_g)),
           ViolationId = iff(isnotempty(custom_details_seriesId_s), custom_details_seriesId_s, tostring(custom_details_seriesId_g))
tactics:
- Exfiltration
queryPeriod: 5m
customDetails:
  EventName: custom_details_eventName_s
  ObjectType: custom_details_objectType_s
  ObjectName: custom_details_objectName_s
  ObjectId: ObjectId
  EventTimestamp: timestamp_t
  Summary: summary_s
  Severity: severity_s
  EventType: class_s
  ViolationId: ViolationId
relevantTechniques:
- T1567
name: Create Incident for Data Security Violation events for DSPM license users
requiredDataConnectors:
- connectorId: RubrikSecurityCloudAzureFunctions
  dataTypes:
  - RubrikViolationData
id: 5b70b78e-397c-474c-a556-f6c37fccbb18
version: 1.0.0
description: |
  'Creates an incident for Data Security Violation events for DSPM license users.'
kind: Scheduled
status: Available

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/5b70b78e-397c-474c-a556-f6c37fccbb18')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5b70b78e-397c-474c-a556-f6c37fccbb18')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{summary_s}}",
          "alertDisplayNameFormat": "{{class_s}} event occurred for object {{custom_details_objectName_s}} with type {{custom_details_objectType_s}}",
          "alertSeverityColumnName": "NewSeverity"
        },
        "alertRuleTemplateName": "5b70b78e-397c-474c-a556-f6c37fccbb18",
        "customDetails": {
          "EventName": "custom_details_eventName_s",
          "EventTimestamp": "timestamp_t",
          "EventType": "class_s",
          "ObjectId": "ObjectId",
          "ObjectName": "custom_details_objectName_s",
          "ObjectType": "custom_details_objectType_s",
          "Severity": "severity_s",
          "Summary": "summary_s",
          "ViolationId": "ViolationId"
        },
        "description": "'Creates an incident for Data Security Violation events for DSPM license users.'\n",
        "displayName": "Create Incident for Data Security Violation events for DSPM license users",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "ViolationId"
            ],
            "lookbackDuration": "P7D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/RubrikSecurityCloud/Analytic%20Rules/RubrikDataSecurityViolation.yaml",
        "query": "Rubrik_Violation_Data_CL\n| where class_s == \"SecurityViolation\" and custom_details_eventName_s in (\"CriticalSeverityDataViolationDetected\",\n\"CriticalSeverityDataViolationReOpen\",\n\"HighSeverityDataViolationDetected\",\n\"HighSeverityDataViolationReOpen\",\n\"LowOrMediumSeverityDataViolationDetected\",\n\"LowOrMediumSeverityDataViolationReOpen\")\n| extend NewSeverity = case(severity_s==\"info\", \"Low\",\n                            severity_s==\"warning\", \"Medium\",\n                            severity_s==\"critical\", \"High\",\n                            \"Informational\"),\n         ObjectId = iff(isnotempty(custom_details_objectId_s), custom_details_objectId_s, tostring(custom_details_objectId_g)),\n         ViolationId = iff(isnotempty(custom_details_seriesId_s), custom_details_seriesId_s, tostring(custom_details_seriesId_g))\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Exfiltration"
        ],
        "techniques": [
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}