Uniqkey - Platform threat detection | Microsoft Sentinel Analytic Rules

Back


Id	712f5770-a5a9-4623-8adc-26cda17294a5
Rulename	Uniqkey - Platform threat detection
Description	Surfaces threat detections generated by the Uniqkey platform itself, such as employee credentials discovered in a data breach, as Microsoft Sentinel alerts. Promoting these vendor-side detections into Microsoft Sentinel lets them be triaged, correlated with other signals and tracked as incidents alongside the rest of the security stack. Each detection is raised as its own alert.
Severity	High
Tactics	InitialAccess CredentialAccess
Techniques	T1078
Required data connectors	UniqkeyEventsConnector
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Platform%20threat%20detection.yaml
Version	1.0.0
Arm template	712f5770-a5a9-4623-8adc-26cda17294a5.json

KQL

UniqkeyEvents_CL
| where Category == "threat_detection"
| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr

YAML

incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: true
    lookbackDuration: 5h
    reopenClosedIncident: false
  createIncident: true
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Platform%20threat%20detection.yaml
triggerThreshold: 0
id: 712f5770-a5a9-4623-8adc-26cda17294a5
suppressionEnabled: false
kind: Scheduled
queryPeriod: 1h
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- InitialAccess
- CredentialAccess
queryFrequency: 1h
severity: High
name: Uniqkey - Platform threat detection
requiredDataConnectors:
- connectorId: UniqkeyEventsConnector
  dataTypes:
  - UniqkeyEvents_CL
version: 1.0.0
relevantTechniques:
- T1078
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: ActorEmail
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SrcIpAddr
query: |-
  UniqkeyEvents_CL
  | where Category == "threat_detection"
  | project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr
suppressionDuration: 5h
description: Surfaces threat detections generated by the Uniqkey platform itself, such as employee credentials discovered in a data breach, as Microsoft Sentinel alerts. Promoting these vendor-side detections into Microsoft Sentinel lets them be triaged, correlated with other signals and tracked as incidents alongside the rest of the security stack. Each detection is raised as its own alert.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/712f5770-a5a9-4623-8adc-26cda17294a5')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/712f5770-a5a9-4623-8adc-26cda17294a5')]",
      "properties": {
        "alertRuleTemplateName": "712f5770-a5a9-4623-8adc-26cda17294a5",
        "customDetails": null,
        "description": "Surfaces threat detections generated by the Uniqkey platform itself, such as employee credentials discovered in a data breach, as Microsoft Sentinel alerts. Promoting these vendor-side detections into Microsoft Sentinel lets them be triaged, correlated with other signals and tracked as incidents alongside the rest of the security stack. Each detection is raised as its own alert.",
        "displayName": "Uniqkey - Platform threat detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "ActorEmail",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SrcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Uniqkey/Analytic%20Rules/Uniqkey%20-%20Platform%20threat%20detection.yaml",
        "query": "UniqkeyEvents_CL\n| where Category == \"threat_detection\"\n| project TimeGenerated, ActorEmail, ActorType, Action, ActionId, TargetType, TargetName, ClientSystem, SrcIpAddr",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}