Claroty - Threat detected

Back


Id	731e5ac4-7fe1-4b06-9941-532f2e008bb3
Rulename	Claroty - Threat detected
Description	Detects Claroty events where EventOriginalType or EventType contains ‘Threat’, identifying Threat-related activity and surfacing the destination IP address for investigation.
Severity	High
Tactics	Discovery Reconnaissance
Techniques	T1018 T1595
Required data connectors	CefAma Claroty ClarotyAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyThreat.yaml
Version	1.0.5
Arm template	731e5ac4-7fe1-4b06-9941-532f2e008bb3.json

KQL

ClarotyEvent
| where EventOriginalType has 'Threat' or EventType has 'Threat'
| extend IPCustomEntity = DstIpAddr

YAML

entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
tactics:
- Discovery
- Reconnaissance
requiredDataConnectors:
- dataTypes:
  - ClarotyEvent
  connectorId: Claroty
- dataTypes:
  - ClarotyEvent
  connectorId: ClarotyAma
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
alertDetailsOverride:
  alertDisplayNameFormat: Claroty Threat detected on {{IPCustomEntity}}
  alertDescriptionFormat: Claroty event type {{EventType}} or original type {{EventOriginalType}} matched Threat on {{IPCustomEntity}}
id: 731e5ac4-7fe1-4b06-9941-532f2e008bb3
severity: High
status: Available
customDetails:
  EventType: EventType
  EventOriginalType: EventOriginalType
  TimeGenerated: TimeGenerated
query: |
  ClarotyEvent
  | where EventOriginalType has 'Threat' or EventType has 'Threat'
  | extend IPCustomEntity = DstIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyThreat.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.5
name: Claroty - Threat detected
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1018
- T1595
description: Detects Claroty events where EventOriginalType or EventType contains 'Threat', identifying Threat-related activity and surfacing the destination IP address for investigation.
triggerOperator: gt

ARM