Lookout - New Threat events found

Lookout_CL
| where details_action_s == 'DETECTED' and type_s == 'THREAT'
| extend DetailsPackageName = details_packageName_s
| extend TargetPlatform = target_platform_s
| extend TargetOsVersion = target_osVersion_s
| extend Type = type_s
| extend Severity = details_severity_s
| extend Classifications = details_classifications_s
| extend Platform = target_platform_s

kind: Scheduled
customDetails:
  Classification: Classifications
  Platform: Platform
  Severity: Severity
  Type: Type
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DetailsPackageName
    identifier: FullName
  - columnName: TargetPlatform
    identifier: OSFamily
  - columnName: TargetOsVersion
    identifier: OSVersion
description: |
    'Created to detect new Threat events from the data which is recently synced by Lookout Solution.'
severity: High
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1057
status: Available
tactics:
- Discovery
name: Lookout - New Threat events found.
id: 7593cc60-e294-402d-9202-279fb3c7d55f
query: |
  Lookout_CL
  | where details_action_s == 'DETECTED' and type_s == 'THREAT'
  | extend DetailsPackageName = details_packageName_s
  | extend TargetPlatform = target_platform_s
  | extend TargetOsVersion = target_osVersion_s
  | extend Type = type_s
  | extend Severity = details_severity_s
  | extend Classifications = details_classifications_s
  | extend Platform = target_platform_s  
requiredDataConnectors:
- dataTypes:
  - Lookout_CL
  connectorId: LookoutAPI
version: 1.0.0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic Rules/LookoutThreatEvent.yaml
queryPeriod: 1h

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7593cc60-e294-402d-9202-279fb3c7d55f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7593cc60-e294-402d-9202-279fb3c7d55f')]",
      "properties": {
        "alertRuleTemplateName": "7593cc60-e294-402d-9202-279fb3c7d55f",
        "customDetails": {
          "Classification": "Classifications",
          "Platform": "Platform",
          "Severity": "Severity",
          "Type": "Type"
        },
        "description": "'Created to detect new Threat events from the data which is recently synced by Lookout Solution.'\n",
        "displayName": "Lookout - New Threat events found.",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DetailsPackageName",
                "identifier": "FullName"
              },
              {
                "columnName": "TargetPlatform",
                "identifier": "OSFamily"
              },
              {
                "columnName": "TargetOsVersion",
                "identifier": "OSVersion"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic Rules/LookoutThreatEvent.yaml",
        "query": "Lookout_CL\n| where details_action_s == 'DETECTED' and type_s == 'THREAT'\n| extend DetailsPackageName = details_packageName_s\n| extend TargetPlatform = target_platform_s\n| extend TargetOsVersion = target_osVersion_s\n| extend Type = type_s\n| extend Severity = details_severity_s\n| extend Classifications = details_classifications_s\n| extend Platform = target_platform_s\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery"
        ],
        "techniques": [
          "T1057"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}