Claroty - New Asset | Microsoft Sentinel Analytic Rules

Back


Id	6c29b611-ce69-4016-bf99-eca639fee1f5
Rulename	Claroty - New Asset
Description	Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device or system has been discovered and should be reviewed for authorization, ownership, and expected network placement.
Severity	High
Tactics	InitialAccess Discovery
Techniques	T1190 T1133 T1082
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotyNewAsset.yaml
Version	1.0.4
Arm template	6c29b611-ce69-4016-bf99-eca639fee1f5.json

KQL

ClarotyEvent
| where EventOriginalType has 'New Asset' or EventType has 'New Asset'
| extend IPCustomEntity = SrcIpAddr
| extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))
| extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')
| project IPCustomEntity, AlertTitle, AlertDescription

YAML

entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
name: Claroty - New Asset
kind: Scheduled
triggerOperator: gt
status: Available
queryPeriod: 1h
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
tactics:
- InitialAccess
- Discovery
query: |
  ClarotyEvent
  | where EventOriginalType has 'New Asset' or EventType has 'New Asset'
  | extend IPCustomEntity = SrcIpAddr
  | extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))
  | extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')
  | project IPCustomEntity, AlertTitle, AlertDescription
description: |
  'Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device
  or system has been discovered and should be reviewed for authorization, ownership, and expected network placement.'
severity: High
id: 6c29b611-ce69-4016-bf99-eca639fee1f5
triggerThreshold: 0
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotyNewAsset.yaml
version: 1.0.4
relevantTechniques:
- T1190
- T1133
- T1082

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6c29b611-ce69-4016-bf99-eca639fee1f5')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6c29b611-ce69-4016-bf99-eca639fee1f5')]",
      "properties": {
        "alertRuleTemplateName": "6c29b611-ce69-4016-bf99-eca639fee1f5",
        "customDetails": null,
        "description": "'Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device\nor system has been discovered and should be reviewed for authorization, ownership, and expected network placement.'\n",
        "displayName": "Claroty - New Asset",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotyNewAsset.yaml",
        "query": "ClarotyEvent\n| where EventOriginalType has 'New Asset' or EventType has 'New Asset'\n| extend IPCustomEntity = SrcIpAddr\n| extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))\n| extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')\n| project IPCustomEntity, AlertTitle, AlertDescription\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "InitialAccess"
        ],
        "techniques": [
          "T1082",
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}