Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Theom High Risks

Back
Id74b80987-0a62-448c-8779-47b02e17d3cf
RulenameTheom High Risks
Description“Creates Microsoft Sentinel incidents for high risk Theom alerts.”
SeverityHigh
TacticsCollection
CommandAndControl
CredentialAccess
DefenseEvasion
Discovery
Exfiltration
Impact
Reconnaissance
TechniquesT1592
T1589
T1070
T1552
T1619
T1119
T1560
T1530
T1213
T1001
T1041
T1537
T1485
T1486
T1565
Required data connectorsTheom
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TheomRisksHigh.yaml
Version1.0.2
Arm template74b80987-0a62-448c-8779-47b02e17d3cf.json
Deploy To Azure
TheomAlerts_CL
 | where priority_s == "P2"
description: |
    "Creates Microsoft Sentinel incidents for high risk Theom alerts."
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TheomRisksHigh.yaml
severity: High
status: Available
kind: Scheduled
relevantTechniques:
- T1592
- T1589
- T1070
- T1552
- T1619
- T1119
- T1560
- T1530
- T1213
- T1001
- T1041
- T1537
- T1485
- T1486
- T1565
tactics:
- Collection
- CommandAndControl
- CredentialAccess
- DefenseEvasion
- Discovery
- Exfiltration
- Impact
- Reconnaissance
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 5m
entityMappings:
- fieldMappings:
  - columnName: customProps_AssetName_s
    identifier: Name
  entityType: CloudApplication
- fieldMappings:
  - columnName: deepLink_s
    identifier: Url
  entityType: URL
triggerThreshold: 0
queryPeriod: 5m
triggerOperator: gt
version: 1.0.2
id: 74b80987-0a62-448c-8779-47b02e17d3cf
name: Theom High Risks
query: |
  TheomAlerts_CL
   | where priority_s == "P2"  
requiredDataConnectors:
- dataTypes:
  - TheomAlerts_CL
  connectorId: Theom
alertDetailsOverride:
  alertDescriptionFormat: |2

    Summary: {{summary_s}}  
    Additional info: {{details_s}}
    Please investigate further on Theom UI at {{deepLink_s}}
  alertDisplayNameFormat: 'Theom Alert ID: {{id_s}} '
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/74b80987-0a62-448c-8779-47b02e17d3cf')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/74b80987-0a62-448c-8779-47b02e17d3cf')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "\nSummary: {{summary_s}}  \nAdditional info: {{details_s}}\nPlease investigate further on Theom UI at {{deepLink_s}}\n",
          "alertDisplayNameFormat": "Theom Alert ID: {{id_s}} "
        },
        "alertRuleTemplateName": "74b80987-0a62-448c-8779-47b02e17d3cf",
        "customDetails": null,
        "description": "\"Creates Microsoft Sentinel incidents for high risk Theom alerts.\"\n",
        "displayName": "Theom High Risks",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "customProps_AssetName_s",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "deepLink_s",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TheomRisksHigh.yaml",
        "query": "TheomAlerts_CL\n | where priority_s == \"P2\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CommandAndControl",
          "CredentialAccess",
          "DefenseEvasion",
          "Discovery",
          "Exfiltration",
          "Impact",
          "Reconnaissance"
        ],
        "techniques": [
          "T1001",
          "T1041",
          "T1070",
          "T1119",
          "T1213",
          "T1485",
          "T1486",
          "T1530",
          "T1537",
          "T1552",
          "T1560",
          "T1565",
          "T1589",
          "T1592",
          "T1619"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}