TI map Domain entity to SecurityAlert

Back


Id	87890d78-3e05-43ec-9ab9-ba32f4e01250
Rulename	TI map Domain entity to SecurityAlert
Description	Identifies a match in SecurityAlert table from any Domain IOC from TI
Severity	Medium
Tactics	Impact
Required data connectors	AzureSecurityCenter MicrosoftCloudAppSecurity MicrosoftDefenderThreatIntelligence ThreatIntelligence ThreatIntelligenceTaxii
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_SecurityAlert.yaml
Version	1.4.1
Arm template	87890d78-3e05-43ec-9ab9-ba32f4e01250.json

KQL

let dt_lookBack = 1h; // Lookback time for recent data, set to 1 hour
let ioc_lookBack = 14d; // Lookback time for threat feed data, set to 14 days
// Create a list of TLDs in our threat feed for later validation
let list_tlds = ThreatIntelligenceIndicator
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
  | where Active == true and ExpirationDateTime > now()
  | where isnotempty(DomainName)
  | extend parts = split(DomainName, '.')
  | extend tld = parts[(array_length(parts)-1)]
  | summarize count() by tostring(tld)
  | summarize make_list(tld);
let Domain_Indicators = ThreatIntelligenceIndicator
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
  | where Active == true and ExpirationDateTime > now()
  // Picking up only IOC's that contain the entities we want
  | where isnotempty(DomainName)
  | extend TI_DomainEntity = DomainName;
Domain_Indicators
  // Using innerunique to keep performance fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
  | join kind=innerunique (
    SecurityAlert
    | where TimeGenerated > ago(dt_lookBack)
    | extend MSTI = case(AlertName has "TI map" and VendorName == "Microsoft" and ProductName == 'Azure Sentinel', true, false)
    | where MSTI == false
    // Extract domain patterns from message
    | extend domain = todynamic(dynamic_to_json(extract_all(@"(((xn--)?[a-z0-9\-]+\.)+([a-z]+|(xn--[a-z0-9]+)))", dynamic([1,1]), tolower(Entities))))
    | mv-expand domain
    | extend domain = tostring(domain[0])
    | extend parts = split(domain, '.')
    // Split out the TLD
    | extend tld = parts[(array_length(parts)-1)]
    // Validate parsed domain by checking if the TLD is in the list of TLDs in our threat feed
    | where tld in~ (list_tlds)
    // Converting Entities into dynamic data type and use mv-expand to unpack the array
    | extend EntitiesDynamicArray = parse_json(Entities)
    | mv-apply EntitiesDynamicArray on
      (summarize
        HostName = take_anyif(tostring(EntitiesDynamicArray.HostName), EntitiesDynamicArray.Type == "host"),
        IP_addr = take_anyif(tostring(EntitiesDynamicArray.Address), EntitiesDynamicArray.Type == "ip")
      )
    | extend Alert_TimeGenerated = TimeGenerated
    | extend Alert_Description = Description
  ) on $left.TI_DomainEntity == $right.domain
  | where Alert_TimeGenerated < ExpirationDateTime
  | summarize Alert_TimeGenerated = arg_max(Alert_TimeGenerated, *) by IndicatorId, AlertName
  | project Alert_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, AlertName, Alert_Description, ProviderName, AlertSeverity, ConfidenceLevel, HostName, IP_addr, Url, Entities, Type, TI_DomainEntity
  | extend timestamp = Alert_TimeGenerated

YAML

triggerOperator: gt
version: 1.4.1
query: |
  let dt_lookBack = 1h; // Lookback time for recent data, set to 1 hour
  let ioc_lookBack = 14d; // Lookback time for threat feed data, set to 14 days
  // Create a list of TLDs in our threat feed for later validation
  let list_tlds = ThreatIntelligenceIndicator
    | where TimeGenerated >= ago(ioc_lookBack)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
    | where Active == true and ExpirationDateTime > now()
    | where isnotempty(DomainName)
    | extend parts = split(DomainName, '.')
    | extend tld = parts[(array_length(parts)-1)]
    | summarize count() by tostring(tld)
    | summarize make_list(tld);
  let Domain_Indicators = ThreatIntelligenceIndicator
    | where TimeGenerated >= ago(ioc_lookBack)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
    | where Active == true and ExpirationDateTime > now()
    // Picking up only IOC's that contain the entities we want
    | where isnotempty(DomainName)
    | extend TI_DomainEntity = DomainName;
  Domain_Indicators
    // Using innerunique to keep performance fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
    | join kind=innerunique (
      SecurityAlert
      | where TimeGenerated > ago(dt_lookBack)
      | extend MSTI = case(AlertName has "TI map" and VendorName == "Microsoft" and ProductName == 'Azure Sentinel', true, false)
      | where MSTI == false
      // Extract domain patterns from message
      | extend domain = todynamic(dynamic_to_json(extract_all(@"(((xn--)?[a-z0-9\-]+\.)+([a-z]+|(xn--[a-z0-9]+)))", dynamic([1,1]), tolower(Entities))))
      | mv-expand domain
      | extend domain = tostring(domain[0])
      | extend parts = split(domain, '.')
      // Split out the TLD
      | extend tld = parts[(array_length(parts)-1)]
      // Validate parsed domain by checking if the TLD is in the list of TLDs in our threat feed
      | where tld in~ (list_tlds)
      // Converting Entities into dynamic data type and use mv-expand to unpack the array
      | extend EntitiesDynamicArray = parse_json(Entities)
      | mv-apply EntitiesDynamicArray on
        (summarize
          HostName = take_anyif(tostring(EntitiesDynamicArray.HostName), EntitiesDynamicArray.Type == "host"),
          IP_addr = take_anyif(tostring(EntitiesDynamicArray.Address), EntitiesDynamicArray.Type == "ip")
        )
      | extend Alert_TimeGenerated = TimeGenerated
      | extend Alert_Description = Description
    ) on $left.TI_DomainEntity == $right.domain
    | where Alert_TimeGenerated < ExpirationDateTime
    | summarize Alert_TimeGenerated = arg_max(Alert_TimeGenerated, *) by IndicatorId, AlertName
    | project Alert_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, AlertName, Alert_Description, ProviderName, AlertSeverity, ConfidenceLevel, HostName, IP_addr, Url, Entities, Type, TI_DomainEntity
    | extend timestamp = Alert_TimeGenerated  
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostName
    identifier: HostName
- entityType: IP
  fieldMappings:
  - columnName: IP_addr
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: Url
    identifier: Url
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_SecurityAlert.yaml
queryFrequency: 1h
requiredDataConnectors:
- connectorId: ThreatIntelligence
  dataTypes:
  - ThreatIntelligenceIndicator
- connectorId: ThreatIntelligenceTaxii
  dataTypes:
  - ThreatIntelligenceIndicator
- connectorId: MicrosoftCloudAppSecurity
  dataTypes:
  - SecurityAlert
- connectorId: AzureSecurityCenter
  dataTypes:
  - SecurityAlert
- connectorId: MicrosoftDefenderThreatIntelligence
  dataTypes:
  - ThreatIntelligenceIndicator
name: TI map Domain entity to SecurityAlert
queryPeriod: 14d
severity: Medium
kind: Scheduled
tactics:
- Impact
id: 87890d78-3e05-43ec-9ab9-ba32f4e01250
description: |
    'Identifies a match in SecurityAlert table from any Domain IOC from TI'
triggerThreshold: 0

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/87890d78-3e05-43ec-9ab9-ba32f4e01250')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/87890d78-3e05-43ec-9ab9-ba32f4e01250')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "TI map Domain entity to SecurityAlert",
        "description": "'Identifies a match in SecurityAlert table from any Domain IOC from TI'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "let dt_lookBack = 1h; // Lookback time for recent data, set to 1 hour\nlet ioc_lookBack = 14d; // Lookback time for threat feed data, set to 14 days\n// Create a list of TLDs in our threat feed for later validation\nlet list_tlds = ThreatIntelligenceIndicator\n  | where TimeGenerated >= ago(ioc_lookBack)\n  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n  | where Active == true and ExpirationDateTime > now()\n  | where isnotempty(DomainName)\n  | extend parts = split(DomainName, '.')\n  | extend tld = parts[(array_length(parts)-1)]\n  | summarize count() by tostring(tld)\n  | summarize make_list(tld);\nlet Domain_Indicators = ThreatIntelligenceIndicator\n  | where TimeGenerated >= ago(ioc_lookBack)\n  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n  | where Active == true and ExpirationDateTime > now()\n  // Picking up only IOC's that contain the entities we want\n  | where isnotempty(DomainName)\n  | extend TI_DomainEntity = DomainName;\nDomain_Indicators\n  // Using innerunique to keep performance fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated\n  | join kind=innerunique (\n    SecurityAlert\n    | where TimeGenerated > ago(dt_lookBack)\n    | extend MSTI = case(AlertName has \"TI map\" and VendorName == \"Microsoft\" and ProductName == 'Azure Sentinel', true, false)\n    | where MSTI == false\n    // Extract domain patterns from message\n    | extend domain = todynamic(dynamic_to_json(extract_all(@\"(((xn--)?[a-z0-9\\-]+\\.)+([a-z]+|(xn--[a-z0-9]+)))\", dynamic([1,1]), tolower(Entities))))\n    | mv-expand domain\n    | extend domain = tostring(domain[0])\n    | extend parts = split(domain, '.')\n    // Split out the TLD\n    | extend tld = parts[(array_length(parts)-1)]\n    // Validate parsed domain by checking if the TLD is in the list of TLDs in our threat feed\n    | where tld in~ (list_tlds)\n    // Converting Entities into dynamic data type and use mv-expand to unpack the array\n    | extend EntitiesDynamicArray = parse_json(Entities)\n    | mv-apply EntitiesDynamicArray on\n      (summarize\n        HostName = take_anyif(tostring(EntitiesDynamicArray.HostName), EntitiesDynamicArray.Type == \"host\"),\n        IP_addr = take_anyif(tostring(EntitiesDynamicArray.Address), EntitiesDynamicArray.Type == \"ip\")\n      )\n    | extend Alert_TimeGenerated = TimeGenerated\n    | extend Alert_Description = Description\n  ) on $left.TI_DomainEntity == $right.domain\n  | where Alert_TimeGenerated < ExpirationDateTime\n  | summarize Alert_TimeGenerated = arg_max(Alert_TimeGenerated, *) by IndicatorId, AlertName\n  | project Alert_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, AlertName, Alert_Description, ProviderName, AlertSeverity, ConfidenceLevel, HostName, IP_addr, Url, Entities, Type, TI_DomainEntity\n  | extend timestamp = Alert_TimeGenerated\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "alertRuleTemplateName": "87890d78-3e05-43ec-9ab9-ba32f4e01250",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              }
            ],
            "entityType": "Host"
          },
          {
            "fieldMappings": [
              {
                "columnName": "IP_addr",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          },
          {
            "fieldMappings": [
              {
                "columnName": "Url",
                "identifier": "Url"
              }
            ],
            "entityType": "URL"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_SecurityAlert.yaml",
        "templateVersion": "1.4.1"
      }
    }
  ]
}