PAC high severity

Back


Id	7caa1c03-d20b-42f2-ac95-5232f6e570da
Rulename	PAC high severity
Description	High severity alerts found by Prancer.
Severity	High
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	PrancerLogData
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml
Version	1.0.2
Arm template	7caa1c03-d20b-42f2-ac95-5232f6e570da.json

KQL

union prancer_CL
 | where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'
 | project
     Name = name_s,
     Severity = severity_s,
     Description = data_alert_description_s,
     URL = data_alert_url_s,
     Resource = data_data_resourceID_s,
     Config_ID = data_data_configId_s,
     Collection = data_data_applicationName_s,
     MITRE = data_alert_mitreId_s,
     Company = companyName_s,
     Solution = data_alert_solution_s,
     WASC_ID = data_alert_wascid_s,
     CWE_ID = data_alert_cweid_s,
     Evidence = data_alert_evidence_s,
     Request_Header = data_data_requestHeader_s,
     Request_Body = data_data_requestBody_s,
     Response_Header = data_data_responseHeader_s,
     Response_Body = data_data_responseBody_s,
     Other_Data = data_alert_other_s

YAML

name: PAC high severity
relevantTechniques:
- T1595
id: 7caa1c03-d20b-42f2-ac95-5232f6e570da
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml
requiredDataConnectors:
- dataTypes:
  - prancer_CL
  connectorId: PrancerLogData
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.2
severity: High
triggerThreshold: 0
queryPeriod: 5h
entityMappings:
- fieldMappings:
  - identifier: ResourceId
    columnName: Resource
  entityType: AzureResource
- fieldMappings:
  - identifier: Url
    columnName: URL
  entityType: URL
alertDetailsOverride:
  alertDisplayNameFormat: '{{data_data_message_s}}'
  alertDescriptionFormat: '{{data_data_description_s}}'
  alertDynamicProperties:
  - value: data_data_remediation_description_s
    alertProperty: RemediationSteps
  alertSeverityColumnName: '{{data_data_severity_s}}'
queryFrequency: 5h
status: Available
query: |
  union prancer_CL
   | where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'
   | project
       Name = name_s,
       Severity = severity_s,
       Description = data_alert_description_s,
       URL = data_alert_url_s,
       Resource = data_data_resourceID_s,
       Config_ID = data_data_configId_s,
       Collection = data_data_applicationName_s,
       MITRE = data_alert_mitreId_s,
       Company = companyName_s,
       Solution = data_alert_solution_s,
       WASC_ID = data_alert_wascid_s,
       CWE_ID = data_alert_cweid_s,
       Evidence = data_alert_evidence_s,
       Request_Header = data_data_requestHeader_s,
       Request_Body = data_data_requestBody_s,
       Response_Header = data_data_responseHeader_s,
       Response_Body = data_data_responseBody_s,
       Other_Data = data_alert_other_s  
tactics:
- Reconnaissance
kind: Scheduled
description: |
    'High severity  alerts found by Prancer.'
triggerOperator: gt

ARM