Cyble Vision Alerts Hacktivism

Alerts_hacktivism 
| where Service contains "hacktivism" 
| extend Mappedseverity = Severity

relevantTechniques:
- T1595
- T1491
- T1498
- T1585
queryPeriod: 30m
suppressionDuration: PT5H
query: |
  Alerts_hacktivism 
  | where Service contains "hacktivism" 
  | extend Mappedseverity = Severity
id: 6649e5a0-0365-452f-84b3-448a0aec7a59
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: HK_AttackerTeam
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: HK_All_URLs
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: HK_All_Domains
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: HK_IP
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    reopenClosedIncident: false
    enabled: false
  createIncident: true
description: |
  'Detects hacktivist activity (Telegram posts, defacements, site takedowns, etc.) using the Alerts_Hacktivism parser. Extracts post content, attacker/team,domains, links, IPs, media and metadata for triage.'
kind: Scheduled
triggerOperator: GreaterThan
queryFrequency: 30m
alertDetailsOverride:
  alertDynamicProperties: []
  alertDescriptionFormat: |
    Hacktivism activity detected. Attacker/Team {{HK_AttackerTeam}} Post excerpt {{HK_PostData}} Domains/Links {{HK_All_Domains}}
  alertDisplayNameFormat: CybleVision Hacktivism {{HK_ChannelName}} / {{HK_AttackerTeam}}
severity: Low
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_hacktivism.yaml
tactics:
- Reconnaissance
- Impact
- ResourceDevelopment
triggerThreshold: 0
subTechniques: []
status: Available
enabled: true
version: 1.0.0
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
name: Cyble Vision Alerts Hacktivism
customDetails:
  PostedAt: HK_PostedAt
  Service: Service
  ChannelName: HK_ChannelName
  PostID: HK_PostID
  Emails: HK_Emails
  MappedSeverity: Severity
  Tags: HK_Tags
  TargetDomain: HK_Domain
  Attacker: HK_Attacker
  AlertID: AlertID
  ChannelLink: HK_ChannelLink
  Source: HK_SourceWebsite
  Server: HK_Server
  SourceWebsite: HK_SourceWebsite
  WebsiteURL: HK_WebsiteURL
  PostText: HK_PostData
  Status: Status
  Phones: HK_Phones

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6649e5a0-0365-452f-84b3-448a0aec7a59')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6649e5a0-0365-452f-84b3-448a0aec7a59')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Hacktivism activity detected. Attacker/Team {{HK_AttackerTeam}} Post excerpt {{HK_PostData}} Domains/Links {{HK_All_Domains}}\n",
          "alertDisplayNameFormat": "CybleVision Hacktivism {{HK_ChannelName}} / {{HK_AttackerTeam}}",
          "alertDynamicProperties": []
        },
        "alertRuleTemplateName": "6649e5a0-0365-452f-84b3-448a0aec7a59",
        "customDetails": {
          "AlertID": "AlertID",
          "Attacker": "HK_Attacker",
          "ChannelLink": "HK_ChannelLink",
          "ChannelName": "HK_ChannelName",
          "Emails": "HK_Emails",
          "MappedSeverity": "Severity",
          "Phones": "HK_Phones",
          "PostedAt": "HK_PostedAt",
          "PostID": "HK_PostID",
          "PostText": "HK_PostData",
          "Server": "HK_Server",
          "Service": "Service",
          "Source": "HK_SourceWebsite",
          "SourceWebsite": "HK_SourceWebsite",
          "Status": "Status",
          "Tags": "HK_Tags",
          "TargetDomain": "HK_Domain",
          "WebsiteURL": "HK_WebsiteURL"
        },
        "description": "'Detects hacktivist activity (Telegram posts, defacements, site takedowns, etc.) using the Alerts_Hacktivism parser. Extracts post content, attacker/team,domains, links, IPs, media and metadata for triage.'\n",
        "displayName": "Cyble Vision Alerts Hacktivism",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "HK_AttackerTeam",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "HK_All_URLs",
                "identifier": "Url"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "HK_All_Domains",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "HK_IP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_hacktivism.yaml",
        "query": "Alerts_hacktivism \n| where Service contains \"hacktivism\" \n| extend Mappedseverity = Severity\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "Reconnaissance",
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1491",
          "T1498",
          "T1585",
          "T1595"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}