Claroty - Critical baseline deviation

Back


Id	9a8b4321-e2be-449b-8227-a78227441b2a
Rulename	Claroty - Critical baseline deviation
Description	Detects when critical deviation from baseline occurs.
Severity	High
Tactics	Impact
Techniques	T1529
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml
Version	1.0.3
Arm template	9a8b4321-e2be-449b-8227-a78227441b2a.json

KQL

ClarotyEvent
| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'
| where EventSeverity == '5'
| project TimeGenerated, DstIpAddr
| extend IPCustomEntity = DstIpAddr

YAML

queryPeriod: 1h
id: 9a8b4321-e2be-449b-8227-a78227441b2a
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml
triggerOperator: gt
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
status: Available
kind: Scheduled
name: Claroty - Critical baseline deviation
relevantTechniques:
- T1529
description: |
    'Detects when critical deviation from baseline occurs.'
query: |
  ClarotyEvent
  | where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'
  | where EventSeverity == '5'
  | project TimeGenerated, DstIpAddr
  | extend IPCustomEntity = DstIpAddr  
version: 1.0.3
tactics:
- Impact
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
severity: High
queryFrequency: 1h

ARM