Claroty - New Asset

Back


Id	6c29b611-ce69-4016-bf99-eca639fee1f5
Rulename	Claroty - New Asset
Description	Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device or system has been discovered and should be reviewed for authorization, ownership, and expected network placement.
Severity	High
Tactics	InitialAccess Discovery
Techniques	T1190 T1133 T1082
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml
Version	1.0.4
Arm template	6c29b611-ce69-4016-bf99-eca639fee1f5.json

KQL

ClarotyEvent
| where EventOriginalType has 'New Asset' or EventType has 'New Asset'
| extend IPCustomEntity = SrcIpAddr
| extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))
| extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')
| project IPCustomEntity, AlertTitle, AlertDescription

YAML

queryPeriod: 1h
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
relevantTechniques:
- T1190
- T1133
- T1082
triggerOperator: gt
triggerThreshold: 0
status: Available
name: Claroty - New Asset
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
id: 6c29b611-ce69-4016-bf99-eca639fee1f5
version: 1.0.4
description: |
  'Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device
  or system has been discovered and should be reviewed for authorization, ownership, and expected network placement.'  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml
query: |
  ClarotyEvent
  | where EventOriginalType has 'New Asset' or EventType has 'New Asset'
  | extend IPCustomEntity = SrcIpAddr
  | extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))
  | extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')
  | project IPCustomEntity, AlertTitle, AlertDescription  
queryFrequency: 1h
kind: Scheduled
tactics:
- InitialAccess
- Discovery
severity: High

ARM