NRT GravityZone Incident Alerts

ASimAlertEventBitdefenderGravityZone(pack=true)
  | extend IncidentType = case(
      AdditionalFields.Module == "new-incident", "EDR Incident",
      AdditionalFields.Module == "new-extended-incident", "XDR Incident",
      AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
      AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
      AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
      "Incident"   // fallback value if null or unmatched
    ),
    Tactics = AdditionalFields.AttackTypes
  | project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN

relevantTechniques:
- T1210
severity: Medium
version: 1.0.0
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available
query: |
  ASimAlertEventBitdefenderGravityZone(pack=true)
    | extend IncidentType = case(
        AdditionalFields.Module == "new-incident", "EDR Incident",
        AdditionalFields.Module == "new-extended-incident", "XDR Incident",
        AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
        AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
        AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
        "Incident"   // fallback value if null or unmatched
      ),
      Tactics = AdditionalFields.AttackTypes
    | project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN
name: NRT GravityZone Incident Alerts
alertDetailsOverride:
  alertDynamicProperties:
  - value: EventProduct
    alertProperty: ProductName
  - value: EventVendor
    alertProperty: ProviderName
  alertDescriptionFormat: |
    Alert generated on {{EventStartTime}} in Bitdefender GravityZone.\n\nGravityZone Incident ID / Alert GUID: {{EventUid}}\n\nPlease check the source for more information and investigate further.
  alertTacticsColumnName: Tactics
  alertDisplayNameFormat: 'GravityZone: {{IncidentType}}'
  alertSeverityColumnName: EventSeverity
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DvcHostname
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DvcIpAddr
requiredDataConnectors:
- dataTypes:
  - ASimAlertEventBitdefenderGravityZone
  connectorId: GravityZoneDataConnector
tactics:
- LateralMovement
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GravityZone/Analytic%20Rules/Incidents.yaml
kind: NRT
id: 73c803aa-1188-45dd-8379-62a3319d3d9f
description: The query identifies incident-level events received from the GravityZone Data Connector

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/73c803aa-1188-45dd-8379-62a3319d3d9f')]",
      "kind": "NRT",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/73c803aa-1188-45dd-8379-62a3319d3d9f')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Alert generated on {{EventStartTime}} in Bitdefender GravityZone.\\n\\nGravityZone Incident ID / Alert GUID: {{EventUid}}\\n\\nPlease check the source for more information and investigate further.\n",
          "alertDisplayNameFormat": "GravityZone: {{IncidentType}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "ProductName",
              "value": "EventProduct"
            },
            {
              "alertProperty": "ProviderName",
              "value": "EventVendor"
            }
          ],
          "alertSeverityColumnName": "EventSeverity",
          "alertTacticsColumnName": "Tactics"
        },
        "alertRuleTemplateName": "73c803aa-1188-45dd-8379-62a3319d3d9f",
        "customDetails": null,
        "description": "The query identifies incident-level events received from the GravityZone Data Connector",
        "displayName": "NRT GravityZone Incident Alerts",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DvcHostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DvcIpAddr",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GravityZone/Analytic%20Rules/Incidents.yaml",
        "query": "ASimAlertEventBitdefenderGravityZone(pack=true)\n  | extend IncidentType = case(\n      AdditionalFields.Module == \"new-incident\", \"EDR Incident\",\n      AdditionalFields.Module == \"new-extended-incident\", \"XDR Incident\",\n      AdditionalFields.Module == \"ransomware-mitigation\", \"Ransomware Mitigation\",\n      AdditionalFields.Module == \"network-sandboxing\", \"Sandbox Analyzer Detection\",\n      AdditionalFields.Module == \"exchange-malware\", \"Exchange Malware Detection\",\n      \"Incident\"   // fallback value if null or unmatched\n    ),\n    Tactics = AdditionalFields.AttackTypes\n  | project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN\n",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "LateralMovement"
        ],
        "techniques": [
          "T1210"
        ],
        "templateVersion": "1.0.0"
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}