Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

SecurityBridge A critical event occured

Back
Id8c5c766a-ce9b-4112-b6ed-1b8fe33733b7
RulenameSecurityBridge: A critical event occured
DescriptionThis rule alerts if there is any critical event occured in the SAP system
SeverityMedium
TacticsInitialAccess
TechniquesT1189
Required data connectorsCustomLogsAma
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SecurityBridge App/Analytical Rules/CriticalEventTriggered.yaml
Version1.0.4
Arm template8c5c766a-ce9b-4112-b6ed-1b8fe33733b7.json
Deploy To Azure
SecurityBridgeLogs
| where Severity contains "Critical"
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SecurityBridge App/Analytical Rules/CriticalEventTriggered.yaml
query: |
  SecurityBridgeLogs
  | where Severity contains "Critical"  
description: |
    'This rule alerts if there is any critical event occured in the SAP system'
severity: Medium
requiredDataConnectors:
- datatypes:
  - SecurityBridgeLogs_CL
  connectorId: CustomLogsAma
name: 'SecurityBridge: A critical event occured'
triggerThreshold: 0
tactics:
- InitialAccess
version: 1.0.4
relevantTechniques:
- T1189
triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: maincontact
    identifier: Name
- entityType: Host
  fieldMappings:
  - columnName: dhost
    identifier: HostName
- entityType: Host
  fieldMappings:
  - columnName: dvchost
    identifier: HostName
id: 8c5c766a-ce9b-4112-b6ed-1b8fe33733b7
status: Available
kind: Scheduled
queryFrequency: 5m
queryPeriod: 5m
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8c5c766a-ce9b-4112-b6ed-1b8fe33733b7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8c5c766a-ce9b-4112-b6ed-1b8fe33733b7')]",
      "properties": {
        "alertRuleTemplateName": "8c5c766a-ce9b-4112-b6ed-1b8fe33733b7",
        "customDetails": null,
        "description": "'This rule alerts if there is any critical event occured in the SAP system'\n",
        "displayName": "SecurityBridge: A critical event occured",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "maincontact",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "dhost",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "dvchost",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SecurityBridge App/Analytical Rules/CriticalEventTriggered.yaml",
        "query": "SecurityBridgeLogs\n| where Severity contains \"Critical\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1189"
        ],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}