Defender Alert Evidence | Microsoft Sentinel Analytic Rules

Back


Id	8138863e-e55f-4f02-ac94-72796e203d27
Rulename	Defender Alert Evidence
Description	This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.
Severity	High
Tactics	Persistence
Techniques	T1546
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	60m
Query period	60m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra%20XDR/Analytic%20Rules/Defender_Alert_Evidence.yaml
Version	1.0.0
Arm template	8138863e-e55f-4f02-ac94-72796e203d27.json

KQL

AlertEvidence
| where EntityType in ("Device", "User")

YAML

incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
    matchingMethod: AllEntities
type: Microsoft.OperationalInsights/workspaces/providers/alertRules
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountName
    identifier: Name
- entityType: IP
  fieldMappings:
  - columnName: LocalIP
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: DeviceName
    identifier: HostName
query: |
  AlertEvidence
  | where EntityType in ("Device", "User")
suppressionEnabled: false
eventGroupingSettings:
  aggregationKind: SingleAlert
id: 8138863e-e55f-4f02-ac94-72796e203d27
severity: High
status: Available
suppressionDuration: PT5H
triggerOperator: GreaterThan
relevantTechniques:
- T1546
version: 1.0.0
kind: Scheduled
tactics:
- Persistence
requiredDataConnectors:
- dataTypes:
  - AlertEvidence
  connectorId: MicrosoftThreatProtection
description: This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra%20XDR/Analytic%20Rules/Defender_Alert_Evidence.yaml
queryFrequency: 60m
name: Defender Alert Evidence
triggerThreshold: 0
queryPeriod: 60m

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8138863e-e55f-4f02-ac94-72796e203d27')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8138863e-e55f-4f02-ac94-72796e203d27')]",
      "properties": {
        "alertRuleTemplateName": "8138863e-e55f-4f02-ac94-72796e203d27",
        "customDetails": null,
        "description": "This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.",
        "displayName": "Defender Alert Evidence",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "LocalIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceName",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": false,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra%20XDR/Analytic%20Rules/Defender_Alert_Evidence.yaml",
        "query": "AlertEvidence\n| where EntityType in (\"Device\", \"User\")\n",
        "queryFrequency": "PT60M",
        "queryPeriod": "PT60M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": [
          "T1546"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}