Vectra AI Detect - Suspicious Behaviors by Category

Back


Id	6cb75f65-231f-46c4-a0b3-50ff21ee6ed3
Rulename	Vectra AI Detect - Suspicious Behaviors by Category
Description	Create an incident for each new malicious behavior detected by Vectra Detect for a specific Category. By default, it looks through all tactics. This can be modified to create incident only for a subset of tactics.
Severity	Informational
Tactics	CredentialAccess Discovery LateralMovement Collection CommandAndControl Exfiltration Impact
Techniques	T1003 T1087 T1021 T1119 T1071 T1041 T1499
Required data connectors	CefAma
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Suspected-Behavior-by-Tactics.yaml
Version	1.1.1
Arm template	6cb75f65-231f-46c4-a0b3-50ff21ee6ed3.json

KQL

// Edit this variable to only keep the tactics where an incident needs to be created (Defaults are: "COMMAND & CONTROL", "BOTNET ACTIVITY", "EXFILTRATION", "LATERAL MOVEMENT", "RECONNAISSANCE")   
let configured_tactics = dynamic(["COMMAND & CONTROL", "BOTNET ACTIVITY", "EXFILTRATION", "LATERAL MOVEMENT", "RECONNAISSANCE"]);
CommonSecurityLog
| where DeviceVendor == "Vectra Networks"
| where DeviceProduct == "X Series"
| where DeviceEventClassID != "campaigns" and DeviceEventClassID != "hsc" and DeviceEventClassID != "audit" and DeviceEventClassID != "health" and DeviceEventClassID != "asc" 
| extend Category = coalesce(
                          column_ifexists("DeviceEventCategory", ""), 
                          extract("cat=(.+?)(;|$)", 1, AdditionalExtensions), 
                          ""
                      )
| project-rename threat_score = FlexNumber1
| project-rename certainty_score = FlexNumber2
| project-rename triaged = DeviceCustomString5
| where triaged != "True"
| project-rename vectra_URL = DeviceCustomString4
| project-rename detection_name = DeviceEventClassID
| extend Tactic = case( Category == "COMMAND & CONTROL", "CommandAndControl",
                        Category == "BOTNET ACTIVITY" , "Impact",
                        Category == "EXFILTRATION", "Exfiltration",
                        Category == "LATERAL MOVEMENT", "LateralMovement",
                        Category == "RECONNAISSANCE", "Discovery",
                        "UNKNOWN")
| extend level = case( threat_score <  50 and certainty_score < 50, "Low",
                       threat_score < 50 and certainty_score >= 50 , "Medium", 
                       threat_score >= 50 and certainty_score <= 50, "High", 
                       threat_score >= 50 and certainty_score >= 50, "Critical",
                       "UNKNOWN")
| extend Severity = case(level == "Info", "Informational",level == "Critical", "High", level)
| extend account = extract("account=(.+?);", 1, AdditionalExtensions)
| extend upn = iff(account matches regex ":", tostring(split(account,":")[1]) ,tostring(split(account,":")[0]))
| extend name = tostring(split(upn, "@")[0])
| extend upn_suffix = tostring(split(upn, "@")[1])
| extend source_entity = case(level == "Info", "Informational",level == "Critical", "High", level)
| where Category in (configured_tactics) 
| summarize arg_max(threat_score, *) by source_entity , Activity
| sort by TimeGenerated

YAML

severity: Informational
queryPeriod: 5m
name: Vectra AI Detect - Suspicious Behaviors by Category
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-Suspected-Behavior-by-Tactics.yaml
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: SourceHostName
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: name
    identifier: Name
  - columnName: upn_suffix
    identifier: UPNSuffix
  entityType: Account
alertDetailsOverride:
  alertDescriptionFormat: Source entity is {{source_entity}} and category is {{Category}}. Threat score is {{threat_score}}.
  alertDisplayNameFormat: Vectra AI Detect - {{Activity}} detected
  alertDynamicProperties:
  - value: vectra_URL
    alertProperty: AlertLink
  - value: DeviceProduct
    alertProperty: ProductName
  - value: DeviceVendor
    alertProperty: ProviderName
  - value: certainty_score
    alertProperty: ConfidenceScore
  alertSeverityColumnName: Severity
version: 1.1.1
relevantTechniques:
- T1003
- T1087
- T1021
- T1119
- T1071
- T1041
- T1499
status: Available
id: 6cb75f65-231f-46c4-a0b3-50ff21ee6ed3
queryFrequency: 5m
triggerThreshold: 0
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  AttackType: Activity
  AttackCategory: Category
description: |
  'Create an incident for each new malicious behavior detected by Vectra Detect for a specific Category. 
  By default, it looks through all tactics. This can be modified to create incident only for a subset of tactics.'  
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
tactics:
- CredentialAccess
- Discovery
- LateralMovement
- Collection
- CommandAndControl
- Exfiltration
- Impact
query: |
  // Edit this variable to only keep the tactics where an incident needs to be created (Defaults are: "COMMAND & CONTROL", "BOTNET ACTIVITY", "EXFILTRATION", "LATERAL MOVEMENT", "RECONNAISSANCE")   
  let configured_tactics = dynamic(["COMMAND & CONTROL", "BOTNET ACTIVITY", "EXFILTRATION", "LATERAL MOVEMENT", "RECONNAISSANCE"]);
  CommonSecurityLog
  | where DeviceVendor == "Vectra Networks"
  | where DeviceProduct == "X Series"
  | where DeviceEventClassID != "campaigns" and DeviceEventClassID != "hsc" and DeviceEventClassID != "audit" and DeviceEventClassID != "health" and DeviceEventClassID != "asc" 
  | extend Category = coalesce(
                            column_ifexists("DeviceEventCategory", ""), 
                            extract("cat=(.+?)(;|$)", 1, AdditionalExtensions), 
                            ""
                        )
  | project-rename threat_score = FlexNumber1
  | project-rename certainty_score = FlexNumber2
  | project-rename triaged = DeviceCustomString5
  | where triaged != "True"
  | project-rename vectra_URL = DeviceCustomString4
  | project-rename detection_name = DeviceEventClassID
  | extend Tactic = case( Category == "COMMAND & CONTROL", "CommandAndControl",
                          Category == "BOTNET ACTIVITY" , "Impact",
                          Category == "EXFILTRATION", "Exfiltration",
                          Category == "LATERAL MOVEMENT", "LateralMovement",
                          Category == "RECONNAISSANCE", "Discovery",
                          "UNKNOWN")
  | extend level = case( threat_score <  50 and certainty_score < 50, "Low",
                         threat_score < 50 and certainty_score >= 50 , "Medium", 
                         threat_score >= 50 and certainty_score <= 50, "High", 
                         threat_score >= 50 and certainty_score >= 50, "Critical",
                         "UNKNOWN")
  | extend Severity = case(level == "Info", "Informational",level == "Critical", "High", level)
  | extend account = extract("account=(.+?);", 1, AdditionalExtensions)
  | extend upn = iff(account matches regex ":", tostring(split(account,":")[1]) ,tostring(split(account,":")[0]))
  | extend name = tostring(split(upn, "@")[0])
  | extend upn_suffix = tostring(split(upn, "@")[1])
  | extend source_entity = case(level == "Info", "Informational",level == "Critical", "High", level)
  | where Category in (configured_tactics) 
  | summarize arg_max(threat_score, *) by source_entity , Activity
  | sort by TimeGenerated

ARM