Illumio VEN Suspend Detection Rule | Microsoft Sentinel Analytic Rules

Back


Id	7379f752-18a2-43ca-8b74-70747dd792f8
Rulename	Illumio VEN Suspend Detection Rule
Description	Create Microsoft Sentinel Incident When Ven Goes Into Suspended state
Severity	High
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	IllumioSaaSDataConnector SyslogAma
Kind	Scheduled
Query frequency	60m
Query period	60m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Analytic%20Rules/Illumio_VEN_Suspend_Query.yaml
Version	1.0.6
Arm template	7379f752-18a2-43ca-8b74-70747dd792f8.json

KQL

Illumio_Auditable_Events_CL
| union IllumioSyslogAuditEvents  
| where event_type has 'agent.suspend'
| extend ipaddress = action.src_ip,
      hostname = created_by.agent.hostname
| project-away resource_changes, action, version

YAML

version: 1.0.6
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Analytic%20Rules/Illumio_VEN_Suspend_Query.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - Illumio_Auditable_Events_CL
  connectorId: IllumioSaaSDataConnector
- datatypes:
  - Syslog
  connectorId: SyslogAma
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
kind: Scheduled
alertDetailsOverride:
  alertDescriptionFormat: |
    Illumio VEN Suspended Incident for {{hostname}} generated at {{TimeGenerated}}
  alertDisplayNameFormat: |
    Illumio VEN Suspended Incident for {{hostname}}
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: hostname
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: ipaddress
  entityType: IP
description: |
  'Create Microsoft Sentinel Incident When Ven Goes Into Suspended state'
triggerOperator: gt
status: Available
queryFrequency: 60m
id: 7379f752-18a2-43ca-8b74-70747dd792f8
name: Illumio VEN Suspend Detection Rule
severity: High
query: |
  Illumio_Auditable_Events_CL
  | union IllumioSyslogAuditEvents  
  | where event_type has 'agent.suspend'
  | extend ipaddress = action.src_ip,
        hostname = created_by.agent.hostname
  | project-away resource_changes, action, version        
queryPeriod: 60m
eventGroupingSettings:
  aggregationKind: SingleAlert

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7379f752-18a2-43ca-8b74-70747dd792f8')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7379f752-18a2-43ca-8b74-70747dd792f8')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Illumio VEN Suspended Incident for {{hostname}} generated at {{TimeGenerated}}\n",
          "alertDisplayNameFormat": "Illumio VEN Suspended Incident for {{hostname}}\n"
        },
        "alertRuleTemplateName": "7379f752-18a2-43ca-8b74-70747dd792f8",
        "customDetails": null,
        "description": "'Create Microsoft Sentinel Incident When Ven Goes Into Suspended state'\n",
        "displayName": "Illumio VEN Suspend Detection Rule",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "hostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "ipaddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Analytic%20Rules/Illumio_VEN_Suspend_Query.yaml",
        "query": "Illumio_Auditable_Events_CL\n| union IllumioSyslogAuditEvents  \n| where event_type has 'agent.suspend'\n| extend ipaddress = action.src_ip,\n      hostname = created_by.agent.hostname\n| project-away resource_changes, action, version        \n",
        "queryFrequency": "PT60M",
        "queryPeriod": "PT60M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.6",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}