Claroty - New Asset | Microsoft Sentinel Analytic Rules

Back


Id	6c29b611-ce69-4016-bf99-eca639fee1f5
Rulename	Claroty - New Asset
Description	Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device or system has been discovered and should be reviewed for authorization, ownership, and expected network placement.
Severity	High
Tactics	InitialAccess Discovery
Techniques	T1190 T1133 T1082
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotyNewAsset.yaml
Version	1.0.4
Arm template	6c29b611-ce69-4016-bf99-eca639fee1f5.json

KQL

ClarotyEvent
| where EventOriginalType has 'New Asset' or EventType has 'New Asset'
| extend IPCustomEntity = SrcIpAddr
| extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))
| extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')
| project IPCustomEntity, AlertTitle, AlertDescription

YAML

triggerThreshold: 0
kind: Scheduled
description: |
  'Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device
  or system has been discovered and should be reviewed for authorization, ownership, and expected network placement.'
queryFrequency: 1h
triggerOperator: gt
relevantTechniques:
- T1190
- T1133
- T1082
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
id: 6c29b611-ce69-4016-bf99-eca639fee1f5
query: |
  ClarotyEvent
  | where EventOriginalType has 'New Asset' or EventType has 'New Asset'
  | extend IPCustomEntity = SrcIpAddr
  | extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))
  | extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')
  | project IPCustomEntity, AlertTitle, AlertDescription
version: 1.0.4
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotyNewAsset.yaml
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
tactics:
- InitialAccess
- Discovery
queryPeriod: 1h
severity: High
status: Available
name: Claroty - New Asset

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6c29b611-ce69-4016-bf99-eca639fee1f5')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6c29b611-ce69-4016-bf99-eca639fee1f5')]",
      "properties": {
        "alertRuleTemplateName": "6c29b611-ce69-4016-bf99-eca639fee1f5",
        "customDetails": null,
        "description": "'Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device\nor system has been discovered and should be reviewed for authorization, ownership, and expected network placement.'\n",
        "displayName": "Claroty - New Asset",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPCustomEntity",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic%20Rules/ClarotyNewAsset.yaml",
        "query": "ClarotyEvent\n| where EventOriginalType has 'New Asset' or EventType has 'New Asset'\n| extend IPCustomEntity = SrcIpAddr\n| extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))\n| extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')\n| project IPCustomEntity, AlertTitle, AlertDescription\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "InitialAccess"
        ],
        "techniques": [
          "T1082",
          "T1133",
          "T1190"
        ],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}