Lookout - High Severity Mobile Threats Detected v2 | Microsoft Sentinel Analytic Rules

Back


Id	8b4a5c7e-2f91-4d8a-9e3b-1c6f8a2d4e9f
Rulename	Lookout - High Severity Mobile Threats Detected (v2)
Description	Detects high severity mobile threats from Lookout Mobile Risk API v2 with enhanced threat intelligence and device context. This rule leverages the comprehensive v2 field set to provide detailed threat classification, risk assessment, and device compliance status for improved security monitoring.
Severity	High
Tactics	Discovery DefenseEvasion Persistence PrivilegeEscalation
Techniques	T1424 T1418 T1629 T1630
Required data connectors	LookoutAPI
Kind	Scheduled
Query frequency	5m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutThreatEventV2.yaml
Version	2.0.5
Arm template	8b4a5c7e-2f91-4d8a-9e3b-1c6f8a2d4e9f.json

KQL

LookoutEvents
| where EventType == "THREAT"
| where ThreatSeverity in ("CRITICAL", "HIGH")
| where ThreatStatus in ("OPEN", "ACTIVE")
| where ThreatAction == "DETECTED"
| extend
    ThreatRiskScore = case(
        ThreatSeverity == "CRITICAL", 10,
        ThreatSeverity == "HIGH", 8,
        ThreatSeverity == "MEDIUM", 5,
        ThreatSeverity == "LOW", 2,
        1
    ),
    DeviceRiskLevel = case(
        DeviceSecurityStatus == "THREATS_HIGH", "High",
        DeviceSecurityStatus == "THREATS_MEDIUM", "Medium",
        DeviceSecurityStatus == "THREATS_LOW", "Low",
        "Unknown"
    ),
    ThreatCategory = case(
        ThreatClassifications has "MALWARE", "Malware",
        ThreatClassifications has "PHISHING", "Phishing", 
        ThreatClassifications has "SPYWARE", "Spyware",
        ThreatClassifications has "TROJAN", "Trojan",
        ThreatClassifications has "ADWARE", "Adware",
        "Other"
    )
| extend ComplianceImpact = case(
    DeviceComplianceStatus == "Non-Compliant" and ThreatRiskScore >= 8, "Critical",
    DeviceComplianceStatus == "Non-Compliant" and ThreatRiskScore >= 5, "High", 
    DeviceComplianceStatus == "Partial" and ThreatRiskScore >= 8, "High",
    DeviceComplianceStatus == "Partial" and ThreatRiskScore >= 5, "Medium",
    "Low"
)
| project
    TimeGenerated,
    EventId,
    ThreatId,
    ThreatType,
    ThreatSeverity,
    ThreatRiskScore,
    ThreatCategory,
    ThreatClassifications,
    ThreatStatus,
    ThreatDescription,
    ThreatApplicationName,
    ThreatPackageName,
    ThreatPackageSha,
    DeviceGuid,
    DevicePlatform,
    DeviceOSVersion,
    DeviceManufacturer,
    DeviceModel,
    DeviceEmailAddress,
    DeviceSecurityStatus,
    DeviceRiskLevel,
    DeviceComplianceStatus,
    ComplianceImpact,
    ClientLookoutSDKVersion,
    MDMConnectorId,
    MDMExternalId,
    TargetEmailAddress,
    TargetPlatform,
    ActorType,
    ActorGuid

YAML

customDetails:
  ThreatType: ThreatType
  ComplianceImpact: ComplianceImpact
  ThreatStatus: ThreatStatus
  MDMConnectorId: MDMConnectorId
  DevicePlatform: DevicePlatform
  ThreatClasses: ThreatClassifications
  ThreatRiskScore: ThreatRiskScore
  DeviceSecStatus: DeviceSecurityStatus
  ThreatCategory: ThreatCategory
  ThreatSeverity: ThreatSeverity
  DeviceRiskLevel: DeviceRiskLevel
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: DeviceEmailAddress
    identifier: FullName
  - columnName: TargetEmailAddress
    identifier: Name
- entityType: Host
  fieldMappings:
  - columnName: DeviceGuid
    identifier: HostName
  - columnName: DevicePlatform
    identifier: OSFamily
  - columnName: DeviceOSVersion
    identifier: OSVersion
- entityType: FileHash
  fieldMappings:
  - columnName: ThreatApplicationName
    identifier: Algorithm
  - columnName: ThreatPackageSha
    identifier: Value
tactics:
- Discovery
- DefenseEvasion
- Persistence
- PrivilegeEscalation
status: Available
queryPeriod: 15m
queryFrequency: 5m
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    groupByAlertDetails:
    - ThreatType
    - DeviceGuid
    matchingMethod: Selected
    reopenClosedIncident: false
    groupByCustomDetails:
    - ThreatCategory
    - DevicePlatform
    lookbackDuration: P1D
    groupByEntities:
    - Account
    - Host
requiredDataConnectors:
- connectorId: LookoutAPI
  dataTypes:
  - LookoutEvents
severity: High
relevantTechniques:
- T1424
- T1418
- T1629
- T1630
name: Lookout - High Severity Mobile Threats Detected (v2)
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutThreatEventV2.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |
  'Detects high severity mobile threats from Lookout Mobile Risk API v2 with enhanced threat intelligence and device context. This rule leverages the comprehensive v2 field set to provide detailed threat classification, risk assessment, and device compliance status for improved security monitoring.'
triggerOperator: gt
alertDetailsOverride:
  alertTacticsColumnName: ThreatCategory
  alertSeverityColumnName: ThreatSeverity
  alertDescriptionFormat: '{{ThreatSeverity}} {{ThreatCategory}} threat on {{DevicePlatform}}'
  alertDisplayNameFormat: 'High Severity Mobile Threat: {{ThreatType}} on {{DevicePlatform}} Device'
id: 8b4a5c7e-2f91-4d8a-9e3b-1c6f8a2d4e9f
version: 2.0.5
triggerThreshold: 0
suppressionDuration: PT1H
suppressionEnabled: false
query: |
  LookoutEvents
  | where EventType == "THREAT"
  | where ThreatSeverity in ("CRITICAL", "HIGH")
  | where ThreatStatus in ("OPEN", "ACTIVE")
  | where ThreatAction == "DETECTED"
  | extend
      ThreatRiskScore = case(
          ThreatSeverity == "CRITICAL", 10,
          ThreatSeverity == "HIGH", 8,
          ThreatSeverity == "MEDIUM", 5,
          ThreatSeverity == "LOW", 2,
          1
      ),
      DeviceRiskLevel = case(
          DeviceSecurityStatus == "THREATS_HIGH", "High",
          DeviceSecurityStatus == "THREATS_MEDIUM", "Medium",
          DeviceSecurityStatus == "THREATS_LOW", "Low",
          "Unknown"
      ),
      ThreatCategory = case(
          ThreatClassifications has "MALWARE", "Malware",
          ThreatClassifications has "PHISHING", "Phishing", 
          ThreatClassifications has "SPYWARE", "Spyware",
          ThreatClassifications has "TROJAN", "Trojan",
          ThreatClassifications has "ADWARE", "Adware",
          "Other"
      )
  | extend ComplianceImpact = case(
      DeviceComplianceStatus == "Non-Compliant" and ThreatRiskScore >= 8, "Critical",
      DeviceComplianceStatus == "Non-Compliant" and ThreatRiskScore >= 5, "High", 
      DeviceComplianceStatus == "Partial" and ThreatRiskScore >= 8, "High",
      DeviceComplianceStatus == "Partial" and ThreatRiskScore >= 5, "Medium",
      "Low"
  )
  | project
      TimeGenerated,
      EventId,
      ThreatId,
      ThreatType,
      ThreatSeverity,
      ThreatRiskScore,
      ThreatCategory,
      ThreatClassifications,
      ThreatStatus,
      ThreatDescription,
      ThreatApplicationName,
      ThreatPackageName,
      ThreatPackageSha,
      DeviceGuid,
      DevicePlatform,
      DeviceOSVersion,
      DeviceManufacturer,
      DeviceModel,
      DeviceEmailAddress,
      DeviceSecurityStatus,
      DeviceRiskLevel,
      DeviceComplianceStatus,
      ComplianceImpact,
      ClientLookoutSDKVersion,
      MDMConnectorId,
      MDMExternalId,
      TargetEmailAddress,
      TargetPlatform,
      ActorType,
      ActorGuid

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8b4a5c7e-2f91-4d8a-9e3b-1c6f8a2d4e9f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8b4a5c7e-2f91-4d8a-9e3b-1c6f8a2d4e9f')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{ThreatSeverity}} {{ThreatCategory}} threat on {{DevicePlatform}}",
          "alertDisplayNameFormat": "High Severity Mobile Threat: {{ThreatType}} on {{DevicePlatform}} Device",
          "alertSeverityColumnName": "ThreatSeverity",
          "alertTacticsColumnName": "ThreatCategory"
        },
        "alertRuleTemplateName": "8b4a5c7e-2f91-4d8a-9e3b-1c6f8a2d4e9f",
        "customDetails": {
          "ComplianceImpact": "ComplianceImpact",
          "DevicePlatform": "DevicePlatform",
          "DeviceRiskLevel": "DeviceRiskLevel",
          "DeviceSecStatus": "DeviceSecurityStatus",
          "MDMConnectorId": "MDMConnectorId",
          "ThreatCategory": "ThreatCategory",
          "ThreatClasses": "ThreatClassifications",
          "ThreatRiskScore": "ThreatRiskScore",
          "ThreatSeverity": "ThreatSeverity",
          "ThreatStatus": "ThreatStatus",
          "ThreatType": "ThreatType"
        },
        "description": "'Detects high severity mobile threats from Lookout Mobile Risk API v2 with enhanced threat intelligence and device context. This rule leverages the comprehensive v2 field set to provide detailed threat classification, risk assessment, and device compliance status for improved security monitoring.'\n",
        "displayName": "Lookout - High Severity Mobile Threats Detected (v2)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "DeviceEmailAddress",
                "identifier": "FullName"
              },
              {
                "columnName": "TargetEmailAddress",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceGuid",
                "identifier": "HostName"
              },
              {
                "columnName": "DevicePlatform",
                "identifier": "OSFamily"
              },
              {
                "columnName": "DeviceOSVersion",
                "identifier": "OSVersion"
              }
            ]
          },
          {
            "entityType": "FileHash",
            "fieldMappings": [
              {
                "columnName": "ThreatApplicationName",
                "identifier": "Algorithm"
              },
              {
                "columnName": "ThreatPackageSha",
                "identifier": "Value"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [
              "ThreatType",
              "DeviceGuid"
            ],
            "groupByCustomDetails": [
              "ThreatCategory",
              "DevicePlatform"
            ],
            "groupByEntities": [
              "Account",
              "Host"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Lookout/Analytic%20Rules/LookoutThreatEventV2.yaml",
        "query": "LookoutEvents\n| where EventType == \"THREAT\"\n| where ThreatSeverity in (\"CRITICAL\", \"HIGH\")\n| where ThreatStatus in (\"OPEN\", \"ACTIVE\")\n| where ThreatAction == \"DETECTED\"\n| extend\n    ThreatRiskScore = case(\n        ThreatSeverity == \"CRITICAL\", 10,\n        ThreatSeverity == \"HIGH\", 8,\n        ThreatSeverity == \"MEDIUM\", 5,\n        ThreatSeverity == \"LOW\", 2,\n        1\n    ),\n    DeviceRiskLevel = case(\n        DeviceSecurityStatus == \"THREATS_HIGH\", \"High\",\n        DeviceSecurityStatus == \"THREATS_MEDIUM\", \"Medium\",\n        DeviceSecurityStatus == \"THREATS_LOW\", \"Low\",\n        \"Unknown\"\n    ),\n    ThreatCategory = case(\n        ThreatClassifications has \"MALWARE\", \"Malware\",\n        ThreatClassifications has \"PHISHING\", \"Phishing\", \n        ThreatClassifications has \"SPYWARE\", \"Spyware\",\n        ThreatClassifications has \"TROJAN\", \"Trojan\",\n        ThreatClassifications has \"ADWARE\", \"Adware\",\n        \"Other\"\n    )\n| extend ComplianceImpact = case(\n    DeviceComplianceStatus == \"Non-Compliant\" and ThreatRiskScore >= 8, \"Critical\",\n    DeviceComplianceStatus == \"Non-Compliant\" and ThreatRiskScore >= 5, \"High\", \n    DeviceComplianceStatus == \"Partial\" and ThreatRiskScore >= 8, \"High\",\n    DeviceComplianceStatus == \"Partial\" and ThreatRiskScore >= 5, \"Medium\",\n    \"Low\"\n)\n| project\n    TimeGenerated,\n    EventId,\n    ThreatId,\n    ThreatType,\n    ThreatSeverity,\n    ThreatRiskScore,\n    ThreatCategory,\n    ThreatClassifications,\n    ThreatStatus,\n    ThreatDescription,\n    ThreatApplicationName,\n    ThreatPackageName,\n    ThreatPackageSha,\n    DeviceGuid,\n    DevicePlatform,\n    DeviceOSVersion,\n    DeviceManufacturer,\n    DeviceModel,\n    DeviceEmailAddress,\n    DeviceSecurityStatus,\n    DeviceRiskLevel,\n    DeviceComplianceStatus,\n    ComplianceImpact,\n    ClientLookoutSDKVersion,\n    MDMConnectorId,\n    MDMExternalId,\n    TargetEmailAddress,\n    TargetPlatform,\n    ActorType,\n    ActorGuid\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Discovery",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": null,
        "templateVersion": "2.0.5",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}