ASimAlertEventBitdefenderGravityZone(pack=true)
| extend IncidentType = case(
AdditionalFields.Module == "new-incident", "EDR Incident",
AdditionalFields.Module == "new-extended-incident", "XDR Incident",
AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
"Incident" // fallback value if null or unmatched
),
Tactics = AdditionalFields.AttackTypes
| project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: DvcHostname
- entityType: IP
fieldMappings:
- identifier: Address
columnName: DvcIpAddr
tactics:
- LateralMovement
requiredDataConnectors:
- dataTypes:
- ASimAlertEventBitdefenderGravityZone
connectorId: GravityZoneDataConnector
alertDetailsOverride:
alertDescriptionFormat: |
Alert generated on {{EventStartTime}} in Bitdefender GravityZone.\n\nGravityZone Incident ID / Alert GUID: {{EventUid}}\n\nPlease check the source for more information and investigate further.
alertTacticsColumnName: Tactics
alertDisplayNameFormat: 'GravityZone: {{IncidentType}}'
alertDynamicProperties:
- value: EventProduct
alertProperty: ProductName
- value: EventVendor
alertProperty: ProviderName
alertSeverityColumnName: EventSeverity
id: 73c803aa-1188-45dd-8379-62a3319d3d9f
severity: Medium
status: Available
query: |
ASimAlertEventBitdefenderGravityZone(pack=true)
| extend IncidentType = case(
AdditionalFields.Module == "new-incident", "EDR Incident",
AdditionalFields.Module == "new-extended-incident", "XDR Incident",
AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
"Incident" // fallback value if null or unmatched
),
Tactics = AdditionalFields.AttackTypes
| project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GravityZone/Analytic Rules/Incidents.yaml
kind: NRT
name: NRT GravityZone Incident Alerts
description: The query identifies incident-level events received from the GravityZone Data Connector
eventGroupingSettings:
aggregationKind: AlertPerResult
relevantTechniques:
- T1210
version: 1.0.0
