Lookout_CL
| where details_action_s == 'DETECTED' and type_s == 'THREAT'
| extend DetailsPackageName = details_packageName_s
| extend TargetPlatform = target_platform_s
| extend TargetOsVersion = target_osVersion_s
| extend Type = type_s
| extend Severity = details_severity_s
| extend Classifications = details_classifications_s
| extend Platform = target_platform_s
version: 1.0.0
status: Available
queryFrequency: 1h
requiredDataConnectors:
- connectorId: LookoutAPI
dataTypes:
- Lookout_CL
entityMappings:
- fieldMappings:
- columnName: DetailsPackageName
identifier: FullName
- columnName: TargetPlatform
identifier: OSFamily
- columnName: TargetOsVersion
identifier: OSVersion
entityType: Host
kind: Scheduled
queryPeriod: 1h
severity: High
query: |
Lookout_CL
| where details_action_s == 'DETECTED' and type_s == 'THREAT'
| extend DetailsPackageName = details_packageName_s
| extend TargetPlatform = target_platform_s
| extend TargetOsVersion = target_osVersion_s
| extend Type = type_s
| extend Severity = details_severity_s
| extend Classifications = details_classifications_s
| extend Platform = target_platform_s
triggerOperator: gt
id: 7593cc60-e294-402d-9202-279fb3c7d55f
description: |
'Created to detect new Threat events from the data which is recently synced by Lookout Solution.'
triggerThreshold: 0
name: Lookout - New Threat events found.
relevantTechniques:
- T1057
tactics:
- Discovery
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic Rules/LookoutThreatEvent.yaml
customDetails:
Severity: Severity
Type: Type
Platform: Platform
Classification: Classifications
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7593cc60-e294-402d-9202-279fb3c7d55f')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7593cc60-e294-402d-9202-279fb3c7d55f')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01",
"properties": {
"displayName": "Lookout - New Threat events found.",
"description": "'Created to detect new Threat events from the data which is recently synced by Lookout Solution.'\n",
"severity": "High",
"enabled": true,
"query": "Lookout_CL\n| where details_action_s == 'DETECTED' and type_s == 'THREAT'\n| extend DetailsPackageName = details_packageName_s\n| extend TargetPlatform = target_platform_s\n| extend TargetOsVersion = target_osVersion_s\n| extend Type = type_s\n| extend Severity = details_severity_s\n| extend Classifications = details_classifications_s\n| extend Platform = target_platform_s\n",
"queryFrequency": "PT1H",
"queryPeriod": "PT1H",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Discovery"
],
"techniques": [
"T1057"
],
"alertRuleTemplateName": "7593cc60-e294-402d-9202-279fb3c7d55f",
"customDetails": {
"Severity": "Severity",
"Type": "Type",
"Platform": "Platform",
"Classification": "Classifications"
},
"entityMappings": [
{
"entityType": "Host",
"fieldMappings": [
{
"identifier": "FullName",
"columnName": "DetailsPackageName"
},
{
"identifier": "OSFamily",
"columnName": "TargetPlatform"
},
{
"identifier": "OSVersion",
"columnName": "TargetOsVersion"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic Rules/LookoutThreatEvent.yaml",
"status": "Available",
"templateVersion": "1.0.0"
}
}
]
}