Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Sonrai Ticket Escalation Executed

Back
Id822fff15-ea68-4d0f-94ee-b4482ddb6f3a
RulenameSonrai Ticket Escalation Executed
DescriptionChecks if Sonrai tickets have had an escalation executed.

It uses the action type to check if a ticket has had an escalation executed
SeverityMedium
TacticsCollection
CommandAndControl
CredentialAccess
DefenseEvasion
Discovery
Execution
Exfiltration
Impact
InitialAccess
LateralMovement
Persistence
PrivilegeEscalation
TechniquesT1566
T1059
T1547
T1548
T1562
T1003
T1087
T1021
T1119
T1071
T1041
T1499
Required data connectorsSonraiDataConnector
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic Rules/SonraiTicketEscalationExecuted.yaml
Version1.0.2
Arm template822fff15-ea68-4d0f-94ee-b4482ddb6f3a.json
Deploy To Azure
Sonrai_Tickets_CL
| where action_d == 8
status: Available
queryFrequency: 5m
description: |
  'Checks if Sonrai tickets have had an escalation executed. 
  It uses the action type to check if a ticket has had an escalation executed'  
customDetails:
  ticketName: digest_title_s
  ticketStatus: digest_status_s
  resourceLabel: digest_resourceLabel_s
  resourceType: digest_resourceType_s
  ticketOrg: digest_org_s
  criticalResource: digest_criticalResourceName_s
  ticketSeverity: digest_severityCategory_s
severity: Medium
version: 1.0.2
relevantTechniques:
- T1566
- T1059
- T1547
- T1548
- T1562
- T1003
- T1087
- T1021
- T1119
- T1071
- T1041
- T1499
kind: Scheduled
name: Sonrai Ticket Escalation Executed
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  Sonrai_Tickets_CL
  | where action_d == 8  
alertDetailsOverride:
  alertDisplayNameFormat: Escalation Executed - {{digest_ticketSrn_s}} - {{digest_ticketKeyName_s}}
  alertDescriptionFormat: digest_ticketKeyDescription_s
  alertSeverityColumnName: digest_severityCategory_s
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic Rules/SonraiTicketEscalationExecuted.yaml
requiredDataConnectors:
- connectorId: SonraiDataConnector
  dataTypes:
  - Sonrai_Tickets_CL
tactics:
- Collection
- CommandAndControl
- CredentialAccess
- DefenseEvasion
- Discovery
- Execution
- Exfiltration
- Impact
- InitialAccess
- LateralMovement
- Persistence
- PrivilegeEscalation
id: 822fff15-ea68-4d0f-94ee-b4482ddb6f3a
queryPeriod: 5m
entityMappings:
- fieldMappings:
  - columnName: digest_criticalResourceName_s
    identifier: Name
  entityType: CloudApplication
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/822fff15-ea68-4d0f-94ee-b4482ddb6f3a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/822fff15-ea68-4d0f-94ee-b4482ddb6f3a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "digest_ticketKeyDescription_s",
          "alertDisplayNameFormat": "Escalation Executed - {{digest_ticketSrn_s}} - {{digest_ticketKeyName_s}}",
          "alertSeverityColumnName": "digest_severityCategory_s"
        },
        "alertRuleTemplateName": "822fff15-ea68-4d0f-94ee-b4482ddb6f3a",
        "customDetails": {
          "criticalResource": "digest_criticalResourceName_s",
          "resourceLabel": "digest_resourceLabel_s",
          "resourceType": "digest_resourceType_s",
          "ticketName": "digest_title_s",
          "ticketOrg": "digest_org_s",
          "ticketSeverity": "digest_severityCategory_s",
          "ticketStatus": "digest_status_s"
        },
        "description": "'Checks if Sonrai tickets have had an escalation executed. \nIt uses the action type to check if a ticket has had an escalation executed'\n",
        "displayName": "Sonrai Ticket Escalation Executed",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "digest_criticalResourceName_s",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic Rules/SonraiTicketEscalationExecuted.yaml",
        "query": "Sonrai_Tickets_CL\n| where action_d == 8\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CommandAndControl",
          "CredentialAccess",
          "DefenseEvasion",
          "Discovery",
          "Execution",
          "Exfiltration",
          "Impact",
          "InitialAccess",
          "LateralMovement",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1003",
          "T1021",
          "T1041",
          "T1059",
          "T1071",
          "T1087",
          "T1119",
          "T1499",
          "T1547",
          "T1548",
          "T1562",
          "T1566"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}