PAC high severity
Id | 7caa1c03-d20b-42f2-ac95-5232f6e570da |
Rulename | PAC high severity |
Description | High severity alerts found by Prancer. |
Severity | High |
Tactics | Reconnaissance |
Techniques | T1595 |
Required data connectors | PrancerLogData |
Kind | Scheduled |
Query frequency | 5h |
Query period | 5h |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml |
Version | 1.0.2 |
Arm template | 7caa1c03-d20b-42f2-ac95-5232f6e570da.json |
union prancer_CL
| where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'
| project
Name = name_s,
Severity = severity_s,
Description = data_alert_description_s,
URL = data_alert_url_s,
Resource = data_data_resourceID_s,
Config_ID = data_data_configId_s,
Collection = data_data_applicationName_s,
MITRE = data_alert_mitreId_s,
Company = companyName_s,
Solution = data_alert_solution_s,
WASC_ID = data_alert_wascid_s,
CWE_ID = data_alert_cweid_s,
Evidence = data_alert_evidence_s,
Request_Header = data_data_requestHeader_s,
Request_Body = data_data_requestBody_s,
Response_Header = data_data_responseHeader_s,
Response_Body = data_data_responseBody_s,
Other_Data = data_alert_other_s
name: PAC high severity
alertDetailsOverride:
alertDisplayNameFormat: '{{data_data_message_s}}'
alertSeverityColumnName: '{{data_data_severity_s}}'
alertDescriptionFormat: '{{data_data_description_s}}'
alertDynamicProperties:
- alertProperty: RemediationSteps
value: data_data_remediation_description_s
severity: High
queryFrequency: 5h
triggerOperator: gt
relevantTechniques:
- T1595
status: Available
description: |
'High severity alerts found by Prancer.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml
requiredDataConnectors:
- connectorId: PrancerLogData
dataTypes:
- prancer_CL
entityMappings:
- fieldMappings:
- identifier: ResourceId
columnName: Resource
entityType: AzureResource
- fieldMappings:
- identifier: Url
columnName: URL
entityType: URL
eventGroupingSettings:
aggregationKind: SingleAlert
queryPeriod: 5h
tactics:
- Reconnaissance
query: |
union prancer_CL
| where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'
| project
Name = name_s,
Severity = severity_s,
Description = data_alert_description_s,
URL = data_alert_url_s,
Resource = data_data_resourceID_s,
Config_ID = data_data_configId_s,
Collection = data_data_applicationName_s,
MITRE = data_alert_mitreId_s,
Company = companyName_s,
Solution = data_alert_solution_s,
WASC_ID = data_alert_wascid_s,
CWE_ID = data_alert_cweid_s,
Evidence = data_alert_evidence_s,
Request_Header = data_data_requestHeader_s,
Request_Body = data_data_requestBody_s,
Response_Header = data_data_responseHeader_s,
Response_Body = data_data_responseBody_s,
Other_Data = data_alert_other_s
version: 1.0.2
kind: Scheduled
triggerThreshold: 0
id: 7caa1c03-d20b-42f2-ac95-5232f6e570da
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7caa1c03-d20b-42f2-ac95-5232f6e570da')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7caa1c03-d20b-42f2-ac95-5232f6e570da')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "{{data_data_description_s}}",
"alertDisplayNameFormat": "{{data_data_message_s}}",
"alertDynamicProperties": [
{
"alertProperty": "RemediationSteps",
"value": "data_data_remediation_description_s"
}
],
"alertSeverityColumnName": "{{data_data_severity_s}}"
},
"alertRuleTemplateName": "7caa1c03-d20b-42f2-ac95-5232f6e570da",
"customDetails": null,
"description": "'High severity alerts found by Prancer.'\n",
"displayName": "PAC high severity",
"enabled": true,
"entityMappings": [
{
"entityType": "AzureResource",
"fieldMappings": [
{
"columnName": "Resource",
"identifier": "ResourceId"
}
]
},
{
"entityType": "URL",
"fieldMappings": [
{
"columnName": "URL",
"identifier": "Url"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "SingleAlert"
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yaml",
"query": "union prancer_CL\n | where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'\n | project\n Name = name_s,\n Severity = severity_s,\n Description = data_alert_description_s,\n URL = data_alert_url_s,\n Resource = data_data_resourceID_s,\n Config_ID = data_data_configId_s,\n Collection = data_data_applicationName_s,\n MITRE = data_alert_mitreId_s,\n Company = companyName_s,\n Solution = data_alert_solution_s,\n WASC_ID = data_alert_wascid_s,\n CWE_ID = data_alert_cweid_s,\n Evidence = data_alert_evidence_s,\n Request_Header = data_data_requestHeader_s,\n Request_Body = data_data_requestBody_s,\n Response_Header = data_data_responseHeader_s,\n Response_Body = data_data_responseBody_s,\n Other_Data = data_alert_other_s\n",
"queryFrequency": "PT5H",
"queryPeriod": "PT5H",
"severity": "High",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Reconnaissance"
],
"techniques": [
"T1595"
],
"templateVersion": "1.0.2",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}