Atlassian Beacon Alert

Back


Id	83fbf6a2-f227-48f4-8e7b-0b0ecac2381b
Rulename	Atlassian Beacon Alert
Description	The analytic rule creates an incident when an alert is created in Atlassian Beacon. The incident’s events contains values such as alert name, alert url, actor name, actor details, worskpace id of the atlassian beacon, etc. Navigate to the alertDetailURL to view more information on recommendations and remediations.
Severity	High
Required data connectors	AtlassianBeaconAlerts
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Integration for Atlassian Beacon/Analytic Rules/AtlassianBeacon_High.yaml
Version	1.0.1
Arm template	83fbf6a2-f227-48f4-8e7b-0b0ecac2381b.json

KQL

atlassian_beacon_alerts_CL
| project TimeGenerated, detectiontime_d, alert_created_t, alert_title_s, alertTitle_s, alert_url_s, alertDetailURL_s, activity_action_s, alert_product_s, activity_subject_ari_s, actor_name_s, actor_url_s, actor_sessions_s, atlassianAlertType_s, atlassianWorkspace_id_g, atlassianWorkspace_orgId_s, Type

YAML

kind: Scheduled
tactics: []
triggerThreshold: 0
triggerOperator: gt
version: 1.0.1
status: Available
alertDetailsOverride:
  alertDisplayNameFormat: Atlassian Beacon - {alertTitle_s}
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: true
    lookbackDuration: 5h
    reopenClosedIncident: false
suppressionDuration: 5h
queryFrequency: 5m
id: 83fbf6a2-f227-48f4-8e7b-0b0ecac2381b
requiredDataConnectors:
- connectorId: AtlassianBeaconAlerts
  dataTypes:
  - atlassian_beacon_alerts_CL
suppressionEnabled: false
name: Atlassian Beacon Alert
description: |
    'The analytic rule creates an incident when an alert is created in Atlassian Beacon. The incident's events contains values such as alert name, alert url, actor name, actor details, worskpace id of the atlassian beacon, etc. Navigate to the alertDetailURL to view more information on recommendations and remediations.'
customDetails: 
relevantTechniques: []
entityMappings: 
query: |
  atlassian_beacon_alerts_CL
  | project TimeGenerated, detectiontime_d, alert_created_t, alert_title_s, alertTitle_s, alert_url_s, alertDetailURL_s, activity_action_s, alert_product_s, activity_subject_ari_s, actor_name_s, actor_url_s, actor_sessions_s, atlassianAlertType_s, atlassianWorkspace_id_g, atlassianWorkspace_orgId_s, Type  
sentinelEntitiesMappings: 
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Integration for Atlassian Beacon/Analytic Rules/AtlassianBeacon_High.yaml
queryPeriod: 5m
severity: High
eventGroupingSettings:
  aggregationKind: SingleAlert

ARM