Flare chat results

Back


Id	76210211-3ade-47b6-b7f2-c871cd05ec43
Rulename	Flare chat results
Description	This query searches for conversations and posts from real-time messaging environments used by threat actors and fraud communities.
Severity	Medium
Tactics	Reconnaissance
Techniques	T1593
Required data connectors	Flare
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Flare/Analytic Rules/FlareChat.yaml
Version	1.0.0
Arm template	76210211-3ade-47b6-b7f2-c871cd05ec43.json

KQL

FireworkV2_CL
| where notempty(uid) and RiskScore >= 3
| extend index_name = split(uid, "/")[0]
| where index_name == "chat_message"

YAML

relevantTechniques:
- T1593
version: 1.0.0
id: 76210211-3ade-47b6-b7f2-c871cd05ec43
severity: Medium
kind: Scheduled
queryFrequency: 1h
description: |
    'This query searches for conversations and posts from real-time messaging environments used by threat actors and fraud communities.'
requiredDataConnectors:
- connectorId: Flare
  dataTypes:
  - FireworkV2_CL
triggerOperator: gt
name: Flare chat results
tactics:
- Reconnaissance
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Flare/Analytic Rules/FlareChat.yaml
triggerThreshold: 0
queryPeriod: 1h
query: |
  FireworkV2_CL
  | where notempty(uid) and RiskScore >= 3
  | extend index_name = split(uid, "/")[0]
  | where index_name == "chat_message"  
status: Available

ARM