Atlassian Beacon Alert

Back


Id	83fbf6a2-f227-48f4-8e7b-0b0ecac2381b
Rulename	Atlassian Beacon Alert
Description	The analytic rule creates an incident when an alert is created in Atlassian Beacon. The incident’s events contains values such as alert name, alert url, actor name, actor details, worskpace id of the atlassian beacon, etc. Navigate to the alertDetailURL to view more information on recommendations and remediations.
Severity	High
Required data connectors	AtlassianBeaconAlerts
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Integration for Atlassian Beacon/Analytic Rules/AtlassianBeacon_High.yaml
Version	1.0.1
Arm template	83fbf6a2-f227-48f4-8e7b-0b0ecac2381b.json

KQL

atlassian_beacon_alerts_CL
| project TimeGenerated, detectiontime_d, alert_created_t, alert_title_s, alertTitle_s, alert_url_s, alertDetailURL_s, activity_action_s, alert_product_s, activity_subject_ari_s, actor_name_s, actor_url_s, actor_sessions_s, atlassianAlertType_s, atlassianWorkspace_id_g, atlassianWorkspace_orgId_s, Type

YAML

name: Atlassian Beacon Alert
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5h
    matchingMethod: AllEntities
  createIncident: true
query: |
  atlassian_beacon_alerts_CL
  | project TimeGenerated, detectiontime_d, alert_created_t, alert_title_s, alertTitle_s, alert_url_s, alertDetailURL_s, activity_action_s, alert_product_s, activity_subject_ari_s, actor_name_s, actor_url_s, actor_sessions_s, atlassianAlertType_s, atlassianWorkspace_id_g, atlassianWorkspace_orgId_s, Type  
sentinelEntitiesMappings: 
entityMappings: 
queryPeriod: 5m
suppressionEnabled: false
tactics: []
suppressionDuration: 5h
triggerOperator: gt
kind: Scheduled
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Integration for Atlassian Beacon/Analytic Rules/AtlassianBeacon_High.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.1
alertDetailsOverride:
  alertDisplayNameFormat: Atlassian Beacon - {alertTitle_s}
relevantTechniques: []
id: 83fbf6a2-f227-48f4-8e7b-0b0ecac2381b
customDetails: 
severity: High
requiredDataConnectors:
- connectorId: AtlassianBeaconAlerts
  dataTypes:
  - atlassian_beacon_alerts_CL
status: Available
description: |
    'The analytic rule creates an incident when an alert is created in Atlassian Beacon. The incident's events contains values such as alert name, alert url, actor name, actor details, worskpace id of the atlassian beacon, etc. Navigate to the alertDetailURL to view more information on recommendations and remediations.'
queryFrequency: 5m

ARM