SOCRadar High or Critical Severity Alarm | Microsoft Sentinel Analytic Rules

Back


Id	8f3e2c5a-7b91-4d6a-9e8f-1c4a2b5d7e3f
Rulename	SOCRadar High or Critical Severity Alarm
Description	Detects SOCRadar alarms with High or Critical severity levels that require immediate attention. These alarms typically indicate active threats such as credential exposure, ransomware mentions, or targeted attacks against the organization.
Severity	High
Tactics	Reconnaissance InitialAccess
Techniques	T1589 T1078
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SOCRadar/Analytic%20Rules/SOCRadarCriticalAlarmDetection.yaml
Version	1.0.0
Arm template	8f3e2c5a-7b91-4d6a-9e8f-1c4a2b5d7e3f.json

KQL

SOCRadar_Alarms_CL
| where Severity in ("High", "Critical")
| where Status == "OPEN"
| extend AlarmUrl = strcat("https://platform.socradar.com/company/", CompanyId, "/alarms/", AlarmId)
| extend AccountName = tostring(AlarmId)
| project TimeGenerated, AlarmId, Title, AlarmMainType, AlarmSubType, Severity, Status, AlarmUrl, AccountName

YAML

name: SOCRadar High or Critical Severity Alarm
triggerOperator: gt
query: |
  SOCRadar_Alarms_CL
  | where Severity in ("High", "Critical")
  | where Status == "OPEN"
  | extend AlarmUrl = strcat("https://platform.socradar.com/company/", CompanyId, "/alarms/", AlarmId)
  | extend AccountName = tostring(AlarmId)
  | project TimeGenerated, AlarmId, Title, AlarmMainType, AlarmSubType, Severity, Status, AlarmUrl, AccountName
queryFrequency: 15m
description: |
  'Detects SOCRadar alarms with High or Critical severity levels that require immediate attention. These alarms typically indicate active threats such as credential exposure, ransomware mentions, or targeted attacks against the organization.'
id: 8f3e2c5a-7b91-4d6a-9e8f-1c4a2b5d7e3f
triggerThreshold: 0
queryPeriod: 15m
version: 1.0.0
kind: Scheduled
status: Available
severity: High
requiredDataConnectors: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SOCRadar/Analytic%20Rules/SOCRadarCriticalAlarmDetection.yaml
relevantTechniques:
- T1589
- T1078
tactics:
- Reconnaissance
- InitialAccess
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AlarmMainType
  - identifier: Category
    columnName: AlarmSubType
  entityType: Malware
- fieldMappings:
  - identifier: Url
    columnName: AlarmUrl
  entityType: URL

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8f3e2c5a-7b91-4d6a-9e8f-1c4a2b5d7e3f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8f3e2c5a-7b91-4d6a-9e8f-1c4a2b5d7e3f')]",
      "properties": {
        "alertRuleTemplateName": "8f3e2c5a-7b91-4d6a-9e8f-1c4a2b5d7e3f",
        "customDetails": null,
        "description": "'Detects SOCRadar alarms with High or Critical severity levels that require immediate attention. These alarms typically indicate active threats such as credential exposure, ransomware mentions, or targeted attacks against the organization.'\n",
        "displayName": "SOCRadar High or Critical Severity Alarm",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Malware",
            "fieldMappings": [
              {
                "columnName": "AlarmMainType",
                "identifier": "Name"
              },
              {
                "columnName": "AlarmSubType",
                "identifier": "Category"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "AlarmUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SOCRadar/Analytic%20Rules/SOCRadarCriticalAlarmDetection.yaml",
        "query": "SOCRadar_Alarms_CL\n| where Severity in (\"High\", \"Critical\")\n| where Status == \"OPEN\"\n| extend AlarmUrl = strcat(\"https://platform.socradar.com/company/\", CompanyId, \"/alarms/\", AlarmId)\n| extend AccountName = tostring(AlarmId)\n| project TimeGenerated, AlarmId, Title, AlarmMainType, AlarmSubType, Severity, Status, AlarmUrl, AccountName\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess",
          "Reconnaissance"
        ],
        "techniques": [
          "T1078",
          "T1589"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}