PAC high severity
| Id | 7caa1c03-d20b-42f2-ac95-5232f6e570da |
| Rulename | PAC high severity |
| Description | High severity alerts found by Prancer. |
| Severity | High |
| Tactics | Reconnaissance |
| Techniques | T1595 |
| Required data connectors | PrancerLogData |
| Kind | Scheduled |
| Query frequency | 5h |
| Query period | 5h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml |
| Version | 1.0.2 |
| Arm template | 7caa1c03-d20b-42f2-ac95-5232f6e570da.json |
union prancer_CL
| where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'
| project
Name = name_s,
Severity = severity_s,
Description = data_alert_description_s,
URL = data_alert_url_s,
Resource = data_data_resourceID_s,
Config_ID = data_data_configId_s,
Collection = data_data_applicationName_s,
MITRE = data_alert_mitreId_s,
Company = companyName_s,
Solution = data_alert_solution_s,
WASC_ID = data_alert_wascid_s,
CWE_ID = data_alert_cweid_s,
Evidence = data_alert_evidence_s,
Request_Header = data_data_requestHeader_s,
Request_Body = data_data_requestBody_s,
Response_Header = data_data_responseHeader_s,
Response_Body = data_data_responseBody_s,
Other_Data = data_alert_other_s
relevantTechniques:
- T1595
name: PAC high severity
requiredDataConnectors:
- dataTypes:
- prancer_CL
connectorId: PrancerLogData
entityMappings:
- fieldMappings:
- identifier: ResourceId
columnName: Resource
entityType: AzureResource
- fieldMappings:
- identifier: Url
columnName: URL
entityType: URL
triggerThreshold: 0
id: 7caa1c03-d20b-42f2-ac95-5232f6e570da
tactics:
- Reconnaissance
version: 1.0.2
alertDetailsOverride:
alertDynamicProperties:
- alertProperty: RemediationSteps
value: data_data_remediation_description_s
alertDisplayNameFormat: '{{data_data_message_s}}'
alertSeverityColumnName: '{{data_data_severity_s}}'
alertDescriptionFormat: '{{data_data_description_s}}'
queryPeriod: 5h
kind: Scheduled
eventGroupingSettings:
aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml
queryFrequency: 5h
severity: High
status: Available
description: |
'High severity alerts found by Prancer.'
query: |
union prancer_CL
| where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'
| project
Name = name_s,
Severity = severity_s,
Description = data_alert_description_s,
URL = data_alert_url_s,
Resource = data_data_resourceID_s,
Config_ID = data_data_configId_s,
Collection = data_data_applicationName_s,
MITRE = data_alert_mitreId_s,
Company = companyName_s,
Solution = data_alert_solution_s,
WASC_ID = data_alert_wascid_s,
CWE_ID = data_alert_cweid_s,
Evidence = data_alert_evidence_s,
Request_Header = data_data_requestHeader_s,
Request_Body = data_data_requestBody_s,
Response_Header = data_data_responseHeader_s,
Response_Body = data_data_responseBody_s,
Other_Data = data_alert_other_s
triggerOperator: gt
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7caa1c03-d20b-42f2-ac95-5232f6e570da')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7caa1c03-d20b-42f2-ac95-5232f6e570da')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "{{data_data_description_s}}",
"alertDisplayNameFormat": "{{data_data_message_s}}",
"alertDynamicProperties": [
{
"alertProperty": "RemediationSteps",
"value": "data_data_remediation_description_s"
}
],
"alertSeverityColumnName": "{{data_data_severity_s}}"
},
"alertRuleTemplateName": "7caa1c03-d20b-42f2-ac95-5232f6e570da",
"customDetails": null,
"description": "'High severity alerts found by Prancer.'\n",
"displayName": "PAC high severity",
"enabled": true,
"entityMappings": [
{
"entityType": "AzureResource",
"fieldMappings": [
{
"columnName": "Resource",
"identifier": "ResourceId"
}
]
},
{
"entityType": "URL",
"fieldMappings": [
{
"columnName": "URL",
"identifier": "Url"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "SingleAlert"
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml",
"query": "union prancer_CL\n | where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'\n | project\n Name = name_s,\n Severity = severity_s,\n Description = data_alert_description_s,\n URL = data_alert_url_s,\n Resource = data_data_resourceID_s,\n Config_ID = data_data_configId_s,\n Collection = data_data_applicationName_s,\n MITRE = data_alert_mitreId_s,\n Company = companyName_s,\n Solution = data_alert_solution_s,\n WASC_ID = data_alert_wascid_s,\n CWE_ID = data_alert_cweid_s,\n Evidence = data_alert_evidence_s,\n Request_Header = data_data_requestHeader_s,\n Request_Body = data_data_requestBody_s,\n Response_Header = data_data_responseHeader_s,\n Response_Body = data_data_responseBody_s,\n Other_Data = data_alert_other_s\n",
"queryFrequency": "PT5H",
"queryPeriod": "PT5H",
"severity": "High",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Reconnaissance"
],
"techniques": [
"T1595"
],
"templateVersion": "1.0.2",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}