Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Suspicious Mobile App High

Back
Id6e9afac9-6828-486f-b1d8-cf76e86e1224
RulenameSuspicious Mobile App High
DescriptionNew Suspicious Mobile App with severity High found
SeverityHigh
TacticsResourceDevelopment
TechniquesT1587
T1588.002
Required data connectorsCBSPollingIDAzureFunctions
KindScheduled
Query frequency5h
Query period5h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/SuspiciousMobileAppHigh.yaml
Version1.0.2
Arm template6e9afac9-6828-486f-b1d8-cf76e86e1224.json
Deploy To Azure
CBSLog_Azure_1_CL | where severity_s == "High" | where type_s == "Suspicious Mobile App" | where status_s != "Closed" or status_s != "Resolved" | where remarks_s == "New Suspicious Mobile App with severity High found"
queryPeriod: 5h
tactics:
- ResourceDevelopment
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByCustomDetails: []
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    groupByEntities: []
    groupByAlertDetails: []
suppressionEnabled: false
description: |
    'New Suspicious Mobile App with severity High found'
triggerThreshold: 0
suppressionDuration: 5h
query: CBSLog_Azure_1_CL | where severity_s == "High" | where type_s == "Suspicious Mobile App" | where status_s != "Closed" or status_s != "Resolved" | where remarks_s == "New Suspicious Mobile App with severity High found"
severity: High
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 6e9afac9-6828-486f-b1d8-cf76e86e1224
kind: Scheduled
version: 1.0.2
status: Available
triggerOperator: gt
queryFrequency: 5h
name: Suspicious Mobile App High
relevantTechniques:
- T1587
- T1588.002
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: subject_s
requiredDataConnectors:
- connectorId: CBSPollingIDAzureFunctions
  dataTypes:
  - CBSLog_Azure_1_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/SuspiciousMobileAppHigh.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6e9afac9-6828-486f-b1d8-cf76e86e1224')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6e9afac9-6828-486f-b1d8-cf76e86e1224')]",
      "properties": {
        "alertRuleTemplateName": "6e9afac9-6828-486f-b1d8-cf76e86e1224",
        "customDetails": null,
        "description": "'New Suspicious Mobile App with severity High found'\n",
        "displayName": "Suspicious Mobile App High",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "subject_s",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [],
            "groupByEntities": [],
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/SuspiciousMobileAppHigh.yaml",
        "query": "CBSLog_Azure_1_CL | where severity_s == \"High\" | where type_s == \"Suspicious Mobile App\" | where status_s != \"Closed\" or status_s != \"Resolved\" | where remarks_s == \"New Suspicious Mobile App with severity High found\"",
        "queryFrequency": "PT5H",
        "queryPeriod": "PT5H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1588.002"
        ],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1587",
          "T1588"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}