Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Lookout - New Threat events found.

Back
Id7593cc60-e294-402d-9202-279fb3c7d55f
RulenameLookout - New Threat events found.
DescriptionCreated to detect new Threat events from the data which is recently synced by Lookout Solution.
SeverityHigh
TacticsDiscovery
TechniquesT1057
Required data connectorsLookoutAPI
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic Rules/LookoutThreatEvent.yaml
Version1.0.0
Arm template7593cc60-e294-402d-9202-279fb3c7d55f.json
Deploy To Azure
Lookout_CL
| where details_action_s == 'DETECTED' and type_s == 'THREAT'
| extend DetailsPackageName = details_packageName_s
| extend TargetPlatform = target_platform_s
| extend TargetOsVersion = target_osVersion_s
| extend Type = type_s
| extend Severity = details_severity_s
| extend Classifications = details_classifications_s
| extend Platform = target_platform_s
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic Rules/LookoutThreatEvent.yaml
description: |
    'Created to detect new Threat events from the data which is recently synced by Lookout Solution.'
triggerOperator: gt
customDetails:
  Type: Type
  Severity: Severity
  Classification: Classifications
  Platform: Platform
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - Lookout_CL
  connectorId: LookoutAPI
queryFrequency: 1h
triggerThreshold: 0
tactics:
- Discovery
query: |
  Lookout_CL
  | where details_action_s == 'DETECTED' and type_s == 'THREAT'
  | extend DetailsPackageName = details_packageName_s
  | extend TargetPlatform = target_platform_s
  | extend TargetOsVersion = target_osVersion_s
  | extend Type = type_s
  | extend Severity = details_severity_s
  | extend Classifications = details_classifications_s
  | extend Platform = target_platform_s  
status: Available
kind: Scheduled
relevantTechniques:
- T1057
version: 1.0.0
id: 7593cc60-e294-402d-9202-279fb3c7d55f
entityMappings:
- fieldMappings:
  - columnName: DetailsPackageName
    identifier: FullName
  - columnName: TargetPlatform
    identifier: OSFamily
  - columnName: TargetOsVersion
    identifier: OSVersion
  entityType: Host
name: Lookout - New Threat events found.
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7593cc60-e294-402d-9202-279fb3c7d55f')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7593cc60-e294-402d-9202-279fb3c7d55f')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Lookout - New Threat events found.",
        "description": "'Created to detect new Threat events from the data which is recently synced by Lookout Solution.'\n",
        "severity": "High",
        "enabled": true,
        "query": "Lookout_CL\n| where details_action_s == 'DETECTED' and type_s == 'THREAT'\n| extend DetailsPackageName = details_packageName_s\n| extend TargetPlatform = target_platform_s\n| extend TargetOsVersion = target_osVersion_s\n| extend Type = type_s\n| extend Severity = details_severity_s\n| extend Classifications = details_classifications_s\n| extend Platform = target_platform_s\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery"
        ],
        "techniques": [
          "T1057"
        ],
        "alertRuleTemplateName": "7593cc60-e294-402d-9202-279fb3c7d55f",
        "customDetails": {
          "Type": "Type",
          "Severity": "Severity",
          "Classification": "Classifications",
          "Platform": "Platform"
        },
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DetailsPackageName",
                "identifier": "FullName"
              },
              {
                "columnName": "TargetPlatform",
                "identifier": "OSFamily"
              },
              {
                "columnName": "TargetOsVersion",
                "identifier": "OSVersion"
              }
            ]
          }
        ],
        "status": "Available",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic Rules/LookoutThreatEvent.yaml",
        "templateVersion": "1.0.0"
      }
    }
  ]
}