Lookout - New Threat events found | Microsoft Sentinel Analytic Rules

Back


Id	7593cc60-e294-402d-9202-279fb3c7d55f
Rulename	Lookout - New Threat events found.
Description	Created to detect new Threat events from the data which is recently synced by Lookout Solution.
Severity	High
Tactics	Discovery
Techniques	T1057
Required data connectors	LookoutAPI
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutThreatEvent.yaml
Version	1.0.1
Arm template	7593cc60-e294-402d-9202-279fb3c7d55f.json

KQL

Lookout_CL
| where details_action_s == 'DETECTED' and type_s == 'THREAT'
| extend DetailsPackageName = details_packageName_s
| extend TargetPlatform = target_platform_s
| extend TargetOsVersion = target_osVersion_s
| extend Type = type_s
| extend Severity = details_severity_s
| extend Classifications = details_classifications_s
| extend Platform = target_platform_s

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutThreatEvent.yaml
entityMappings:
- fieldMappings:
  - columnName: DetailsPackageName
    identifier: FullName
  - columnName: TargetPlatform
    identifier: OSFamily
  - columnName: TargetOsVersion
    identifier: OSVersion
  entityType: Host
relevantTechniques:
- T1057
triggerOperator: gt
queryPeriod: 1h
severity: High
query: |
  Lookout_CL
  | where details_action_s == 'DETECTED' and type_s == 'THREAT'
  | extend DetailsPackageName = details_packageName_s
  | extend TargetPlatform = target_platform_s
  | extend TargetOsVersion = target_osVersion_s
  | extend Type = type_s
  | extend Severity = details_severity_s
  | extend Classifications = details_classifications_s
  | extend Platform = target_platform_s
id: 7593cc60-e294-402d-9202-279fb3c7d55f
triggerThreshold: 0
customDetails:
  Type: Type
  Platform: Platform
  Classification: Classifications
  Severity: Severity
requiredDataConnectors:
- connectorId: LookoutAPI
  dataTypes:
  - Lookout_CL
queryFrequency: 1h
kind: Scheduled
status: Available
version: 1.0.1
description: |
  'Created to detect new Threat events from the data which is recently synced by Lookout Solution.'
tactics:
- Discovery
name: Lookout - New Threat events found.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7593cc60-e294-402d-9202-279fb3c7d55f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7593cc60-e294-402d-9202-279fb3c7d55f')]",
      "properties": {
        "alertRuleTemplateName": "7593cc60-e294-402d-9202-279fb3c7d55f",
        "customDetails": {
          "Classification": "Classifications",
          "Platform": "Platform",
          "Severity": "Severity",
          "Type": "Type"
        },
        "description": "'Created to detect new Threat events from the data which is recently synced by Lookout Solution.'\n",
        "displayName": "Lookout - New Threat events found.",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DetailsPackageName",
                "identifier": "FullName"
              },
              {
                "columnName": "TargetPlatform",
                "identifier": "OSFamily"
              },
              {
                "columnName": "TargetOsVersion",
                "identifier": "OSVersion"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutThreatEvent.yaml",
        "query": "Lookout_CL\n| where details_action_s == 'DETECTED' and type_s == 'THREAT'\n| extend DetailsPackageName = details_packageName_s\n| extend TargetPlatform = target_platform_s\n| extend TargetOsVersion = target_osVersion_s\n| extend Type = type_s\n| extend Severity = details_severity_s\n| extend Classifications = details_classifications_s\n| extend Platform = target_platform_s\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery"
        ],
        "techniques": [
          "T1057"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}