Check Point Exposure Management - Alert Ingestion Anomaly

let lookback = 24h;
let expected_interval = 1h;
let last_record = toscalar(
    argsentdc_CL
    | where TimeGenerated > ago(lookback)
    | summarize max(TimeGenerated)
);
let gap_minutes = datetime_diff('minute', now(), last_record);
// Alert if no records in the last expected_interval, but there WERE records in the lookback period
// (avoids alerting on brand-new deployments with no data yet)
argsentdc_CL
| where TimeGenerated > ago(lookback)
| summarize
    LastIngestionTime = max(TimeGenerated),
    TotalRecords = count(),
    DistinctAlerts = dcount(ref_id)
| where LastIngestionTime < ago(expected_interval)
| extend GapMinutes = datetime_diff('minute', now(), LastIngestionTime)
| project
    LastIngestionTime,
    GapMinutes,
    TotalRecords,
    DistinctAlerts,
    Message = strcat("No Check Point Exposure Management alerts ingested for ", GapMinutes, " minutes. Last record at ", LastIngestionTime)

version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Check%20Point%20Cyberint%20Alerts/Analytic%20Rules/CPEMAlertIngestionAnomaly.yaml
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - argsentdc_CL
  connectorId: CheckPointCyberintAlerts
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
kind: Scheduled
suppressionDuration: 5h
alertDetailsOverride:
  alertDescriptionFormat: '{{Message}}'
  alertDisplayNameFormat: Check Point Exposure Management - Ingestion gap detected ({{GapMinutes}} minutes)
description: |
  Detects when no Check Point Exposure Management alerts have been ingested into the argsentdc_CL table
  for an extended period. This may indicate a failure in the CCP data connector or the
  Importer playbook, a misconfigured API token, or network connectivity issues.
triggerOperator: gt
suppressionEnabled: false
status: Available
queryFrequency: 1h
id: 8d3b9c7e-5a2f-4e1d-b6c8-3f9a7e2d1b4c
name: Check Point Exposure Management - Alert Ingestion Anomaly
severity: Medium
query: |
  let lookback = 24h;
  let expected_interval = 1h;
  let last_record = toscalar(
      argsentdc_CL
      | where TimeGenerated > ago(lookback)
      | summarize max(TimeGenerated)
  );
  let gap_minutes = datetime_diff('minute', now(), last_record);
  // Alert if no records in the last expected_interval, but there WERE records in the lookback period
  // (avoids alerting on brand-new deployments with no data yet)
  argsentdc_CL
  | where TimeGenerated > ago(lookback)
  | summarize
      LastIngestionTime = max(TimeGenerated),
      TotalRecords = count(),
      DistinctAlerts = dcount(ref_id)
  | where LastIngestionTime < ago(expected_interval)
  | extend GapMinutes = datetime_diff('minute', now(), LastIngestionTime)
  | project
      LastIngestionTime,
      GapMinutes,
      TotalRecords,
      DistinctAlerts,
      Message = strcat("No Check Point Exposure Management alerts ingested for ", GapMinutes, " minutes. Last record at ", LastIngestionTime)
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: 24h
    reopenClosedIncident: false
    enabled: true
  createIncident: true
queryPeriod: 24h
eventGroupingSettings:
  aggregationKind: SingleAlert

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8d3b9c7e-5a2f-4e1d-b6c8-3f9a7e2d1b4c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8d3b9c7e-5a2f-4e1d-b6c8-3f9a7e2d1b4c')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{Message}}",
          "alertDisplayNameFormat": "Check Point Exposure Management - Ingestion gap detected ({{GapMinutes}} minutes)"
        },
        "alertRuleTemplateName": "8d3b9c7e-5a2f-4e1d-b6c8-3f9a7e2d1b4c",
        "customDetails": null,
        "description": "Detects when no Check Point Exposure Management alerts have been ingested into the argsentdc_CL table\nfor an extended period. This may indicate a failure in the CCP data connector or the\nImporter playbook, a misconfigured API token, or network connectivity issues.\n",
        "displayName": "Check Point Exposure Management - Alert Ingestion Anomaly",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT24H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Check%20Point%20Cyberint%20Alerts/Analytic%20Rules/CPEMAlertIngestionAnomaly.yaml",
        "query": "let lookback = 24h;\nlet expected_interval = 1h;\nlet last_record = toscalar(\n    argsentdc_CL\n    | where TimeGenerated > ago(lookback)\n    | summarize max(TimeGenerated)\n);\nlet gap_minutes = datetime_diff('minute', now(), last_record);\n// Alert if no records in the last expected_interval, but there WERE records in the lookback period\n// (avoids alerting on brand-new deployments with no data yet)\nargsentdc_CL\n| where TimeGenerated > ago(lookback)\n| summarize\n    LastIngestionTime = max(TimeGenerated),\n    TotalRecords = count(),\n    DistinctAlerts = dcount(ref_id)\n| where LastIngestionTime < ago(expected_interval)\n| extend GapMinutes = datetime_diff('minute', now(), LastIngestionTime)\n| project\n    LastIngestionTime,\n    GapMinutes,\n    TotalRecords,\n    DistinctAlerts,\n    Message = strcat(\"No Check Point Exposure Management alerts ingested for \", GapMinutes, \" minutes. Last record at \", LastIngestionTime)\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT24H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}