Uniqkey - Platform threat detection | Microsoft Sentinel Analytic Rules

Back


Id	712f5770-a5a9-4623-8adc-26cda17294a5
Rulename	Uniqkey - Platform threat detection
Description	Surfaces threat detections generated by the Uniqkey platform itself, such as employee credentials discovered in a data breach, as Microsoft Sentinel alerts. Promoting these vendor-side detections into Microsoft Sentinel lets them be triaged, correlated with other signals and tracked as incidents alongside the rest of the security stack. Each detection is raised as its own alert.
Severity	High
Tactics	InitialAccess CredentialAccess
Techniques	T1078
Required data connectors	UniqkeyEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Platform%20threat%20detection.yaml
Version	1.0.0
Arm template	712f5770-a5a9-4623-8adc-26cda17294a5.json

KQL

UniqkeyEvents_CL
| where Category == "threat_detection"
| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr

YAML

tactics:
- InitialAccess
- CredentialAccess
name: Uniqkey - Platform threat detection
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Platform%20threat%20detection.yaml
version: 1.0.0
queryFrequency: 1h
requiredDataConnectors:
- connectorId: UniqkeyEventsConnector
  dataTypes:
  - UniqkeyEvents_CL
id: 712f5770-a5a9-4623-8adc-26cda17294a5
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: ActorEmail
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
  entityType: IP
queryPeriod: 1h
severity: High
relevantTechniques:
- T1078
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionEnabled: false
description: Surfaces threat detections generated by the Uniqkey platform itself, such as employee credentials discovered in a data breach, as Microsoft Sentinel alerts. Promoting these vendor-side detections into Microsoft Sentinel lets them be triaged, correlated with other signals and tracked as incidents alongside the rest of the security stack. Each detection is raised as its own alert.
triggerOperator: gt
suppressionDuration: 5h
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: true
    matchingMethod: AllEntities
    lookbackDuration: 5h
kind: Scheduled
query: |-
  UniqkeyEvents_CL
  | where Category == "threat_detection"
  | project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/712f5770-a5a9-4623-8adc-26cda17294a5')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/712f5770-a5a9-4623-8adc-26cda17294a5')]",
      "properties": {
        "alertRuleTemplateName": "712f5770-a5a9-4623-8adc-26cda17294a5",
        "customDetails": null,
        "description": "Surfaces threat detections generated by the Uniqkey platform itself, such as employee credentials discovered in a data breach, as Microsoft Sentinel alerts. Promoting these vendor-side detections into Microsoft Sentinel lets them be triaged, correlated with other signals and tracked as incidents alongside the rest of the security stack. Each detection is raised as its own alert.",
        "displayName": "Uniqkey - Platform threat detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Platform%20threat%20detection.yaml",
        "query": "UniqkeyEvents_CL\n| where Category == \"threat_detection\"\n| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}