Sonrai Ticket Escalation Executed | Microsoft Sentinel Analytic Rules

Back


Id	822fff15-ea68-4d0f-94ee-b4482ddb6f3a
Rulename	Sonrai Ticket Escalation Executed
Description	Checks if Sonrai tickets have had an escalation executed. It uses the action type to check if a ticket has had an escalation executed
Severity	Medium
Tactics	Collection CommandAndControl CredentialAccess DefenseEvasion Discovery Execution Exfiltration Impact InitialAccess LateralMovement Persistence PrivilegeEscalation
Techniques	T1566 T1059 T1547 T1548 T1562 T1003 T1087 T1021 T1119 T1071 T1041 T1499
Required data connectors	SonraiDataConnector
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic%20Rules/SonraiTicketEscalationExecuted.yaml
Version	1.0.2
Arm template	822fff15-ea68-4d0f-94ee-b4482ddb6f3a.json

KQL

Sonrai_Tickets_CL
| where action_d == 8

YAML

queryFrequency: 5m
relevantTechniques:
- T1566
- T1059
- T1547
- T1548
- T1562
- T1003
- T1087
- T1021
- T1119
- T1071
- T1041
- T1499
requiredDataConnectors:
- connectorId: SonraiDataConnector
  dataTypes:
  - Sonrai_Tickets_CL
description: |
  'Checks if Sonrai tickets have had an escalation executed. 
  It uses the action type to check if a ticket has had an escalation executed'
entityMappings:
- entityType: CloudApplication
  fieldMappings:
  - columnName: digest_criticalResourceName_s
    identifier: Name
triggerThreshold: 0
id: 822fff15-ea68-4d0f-94ee-b4482ddb6f3a
queryPeriod: 5m
customDetails:
  ticketName: digest_title_s
  resourceLabel: digest_resourceLabel_s
  criticalResource: digest_criticalResourceName_s
  resourceType: digest_resourceType_s
  ticketOrg: digest_org_s
  ticketSeverity: digest_severityCategory_s
  ticketStatus: digest_status_s
alertDetailsOverride:
  alertDisplayNameFormat: Escalation Executed - {{digest_ticketSrn_s}} - {{digest_ticketKeyName_s}}
  alertSeverityColumnName: digest_severityCategory_s
  alertDescriptionFormat: digest_ticketKeyDescription_s
tactics:
- Collection
- CommandAndControl
- CredentialAccess
- DefenseEvasion
- Discovery
- Execution
- Exfiltration
- Impact
- InitialAccess
- LateralMovement
- Persistence
- PrivilegeEscalation
status: Available
version: 1.0.2
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  Sonrai_Tickets_CL
  | where action_d == 8
severity: Medium
triggerOperator: gt
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic%20Rules/SonraiTicketEscalationExecuted.yaml
name: Sonrai Ticket Escalation Executed

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/822fff15-ea68-4d0f-94ee-b4482ddb6f3a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/822fff15-ea68-4d0f-94ee-b4482ddb6f3a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "digest_ticketKeyDescription_s",
          "alertDisplayNameFormat": "Escalation Executed - {{digest_ticketSrn_s}} - {{digest_ticketKeyName_s}}",
          "alertSeverityColumnName": "digest_severityCategory_s"
        },
        "alertRuleTemplateName": "822fff15-ea68-4d0f-94ee-b4482ddb6f3a",
        "customDetails": {
          "criticalResource": "digest_criticalResourceName_s",
          "resourceLabel": "digest_resourceLabel_s",
          "resourceType": "digest_resourceType_s",
          "ticketName": "digest_title_s",
          "ticketOrg": "digest_org_s",
          "ticketSeverity": "digest_severityCategory_s",
          "ticketStatus": "digest_status_s"
        },
        "description": "'Checks if Sonrai tickets have had an escalation executed. \nIt uses the action type to check if a ticket has had an escalation executed'\n",
        "displayName": "Sonrai Ticket Escalation Executed",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "digest_criticalResourceName_s",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic%20Rules/SonraiTicketEscalationExecuted.yaml",
        "query": "Sonrai_Tickets_CL\n| where action_d == 8\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CommandAndControl",
          "CredentialAccess",
          "DefenseEvasion",
          "Discovery",
          "Execution",
          "Exfiltration",
          "Impact",
          "InitialAccess",
          "LateralMovement",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1003",
          "T1021",
          "T1041",
          "T1059",
          "T1071",
          "T1087",
          "T1119",
          "T1499",
          "T1547",
          "T1548",
          "T1562",
          "T1566"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}