Quokka - Malicious Results Detected

let timeRange = 1h;
let appEventsWithMaliciousResults = QscoutAppEvents_CL
| extend AccountCustomEntity = tostring(org_id)
| where TimeGenerated >= ago(timeRange)
| where result_type == 'maliciousness'
| where isnotempty(results.entries);
appEventsWithMaliciousResults
| mv-expand entry = results.entries
| project
    TimeGenerated,
    AccountCustomEntity,
    app_id,
    mdm_source,
    mdm_device_id,
    package,
    platform,
    version,
    rule_id = tostring(entry.ruleId),
    desription = tostring(entry.description),
    threat_level = toint(entry.threatLevel),
    threat_types = tostring(entry.threatTypes)

requiredDataConnectors:
- dataTypes:
  - QscoutAppEvents_CL
  connectorId: QscoutAppEventsCCFDefinition
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Quokka/Analytic%20Rules/MaliciousResultsDetection.yaml
version: 1.0.0
status: Available
queryFrequency: 1h
query: |
  let timeRange = 1h;
  let appEventsWithMaliciousResults = QscoutAppEvents_CL
  | extend AccountCustomEntity = tostring(org_id)
  | where TimeGenerated >= ago(timeRange)
  | where result_type == 'maliciousness'
  | where isnotempty(results.entries);
  appEventsWithMaliciousResults
  | mv-expand entry = results.entries
  | project
      TimeGenerated,
      AccountCustomEntity,
      app_id,
      mdm_source,
      mdm_device_id,
      package,
      platform,
      version,
      rule_id = tostring(entry.ruleId),
      desription = tostring(entry.description),
      threat_level = toint(entry.threatLevel),
      threat_types = tostring(entry.threatTypes)
tactics:
- InitialAccess
- Execution
- Persistence
- PrivilegeEscalation
- DefenseEvasion
- CredentialAccess
- Discovery
- Collection
- CommandAndControl
- Impact
relevantTechniques:
- T1406
- T1409
- T1414
- T1417
- T1418
- T1422
- T1424
- T1429
- T1430
- T1471
- T1474
- T1481
- T1509
- T1512
- T1513
- T1516
- T1517
- T1532
- T1541
- T1544
- T1582
- T1616
- T1617
- T1623
- T1624
- T1625
- T1627
- T1628
- T1629
- T1630
- T1631
- T1633
- T1634
- T1635
- T1636
- T1638
- T1640
- T1641
- T1642
- T1643
id: 97ad71ed-e4c0-4f7a-b1a2-683108bece4f
triggerThreshold: 0
triggerOperator: gt
name: Quokka - Malicious Results Detected
queryPeriod: 1h
severity: Medium
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: Name
  entityType: Account
kind: Scheduled
description: |
  'Detects if there are any malicious results in the app events coming from organization devices.'

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/97ad71ed-e4c0-4f7a-b1a2-683108bece4f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/97ad71ed-e4c0-4f7a-b1a2-683108bece4f')]",
      "properties": {
        "alertRuleTemplateName": "97ad71ed-e4c0-4f7a-b1a2-683108bece4f",
        "customDetails": null,
        "description": "'Detects if there are any malicious results in the app events coming from organization devices.'\n",
        "displayName": "Quokka - Malicious Results Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountCustomEntity",
                "identifier": "Name"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Quokka/Analytic%20Rules/MaliciousResultsDetection.yaml",
        "query": "let timeRange = 1h;\nlet appEventsWithMaliciousResults = QscoutAppEvents_CL\n| extend AccountCustomEntity = tostring(org_id)\n| where TimeGenerated >= ago(timeRange)\n| where result_type == 'maliciousness'\n| where isnotempty(results.entries);\nappEventsWithMaliciousResults\n| mv-expand entry = results.entries\n| project\n    TimeGenerated,\n    AccountCustomEntity,\n    app_id,\n    mdm_source,\n    mdm_device_id,\n    package,\n    platform,\n    version,\n    rule_id = tostring(entry.ruleId),\n    desription = tostring(entry.description),\n    threat_level = toint(entry.threatLevel),\n    threat_types = tostring(entry.threatTypes)\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CommandAndControl",
          "CredentialAccess",
          "DefenseEvasion",
          "Discovery",
          "Execution",
          "Impact",
          "InitialAccess",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": null,
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}