Disks Alerts From Prancer

Back


Id	8c484ef9-d758-4827-9920-f4f77158f03e
Rulename	Disks Alerts From Prancer
Description	High severity disk alerts found by Prancer.
Severity	High
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	PrancerLogData
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Disks_High_Severity.yaml
Version	1.0.2
Arm template	8c484ef9-d758-4827-9920-f4f77158f03e.json

KQL

union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Compute/disks'
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot 
| extend
  id = tostring(snapshot.id),
  structure = tostring(snapshot.structure),
  reference = tostring(snapshot.reference),
  source = tostring(snapshot.source),
  collection = tostring(snapshot.collection),
  type = tostring(snapshot.type),
  region = tostring(snapshot.region),
  resourceTypes = tostring(snapshot.resourceTypes),
  path = tostring(snapshot.path)

YAML

queryPeriod: 5h
query: |
  union prancer_CL
  | where deviceProduct_s == 'azure'
  | where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Compute/disks'
  | where data_data_severity_s == 'High' and data_data_result_s == 'failed'
  | extend snapshot = parse_json(data_data_snapshots_s)
  | mv-expand snapshot 
  | extend
    id = tostring(snapshot.id),
    structure = tostring(snapshot.structure),
    reference = tostring(snapshot.reference),
    source = tostring(snapshot.source),
    collection = tostring(snapshot.collection),
    type = tostring(snapshot.type),
    region = tostring(snapshot.region),
    resourceTypes = tostring(snapshot.resourceTypes),
    path = tostring(snapshot.path)  
name: Disks Alerts From Prancer
entityMappings:
- fieldMappings:
  - columnName: path
    identifier: ResourceId
  entityType: AzureResource
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 5h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Disks_High_Severity.yaml
alertDetailsOverride:
  alertDisplayNameFormat: '{{data_data_message_s}}'
  alertDescriptionFormat: '{{data_data_description_s}}'
  alertDynamicProperties:
  - value: data_data_remediation_description_s
    alertProperty: RemediationSteps
  alertSeverityColumnName: '{{data_data_severity_s}}'
description: |
    'High severity disk alerts found by Prancer.'
kind: Scheduled
version: 1.0.2
status: Available
severity: High
requiredDataConnectors:
- connectorId: PrancerLogData
  dataTypes:
  - prancer_CL
triggerOperator: gt
triggerThreshold: 0
customDetails: 
tactics:
- Reconnaissance
id: 8c484ef9-d758-4827-9920-f4f77158f03e
relevantTechniques:
- T1595

ARM