Claroty - Critical baseline deviation

Back


Id	9a8b4321-e2be-449b-8227-a78227441b2a
Rulename	Claroty - Critical baseline deviation
Description	Detects Claroty events where EventOriginalType or EventType indicates a Baseline Deviation and EventSeverity is 5, which represents a critical deviation from baseline that may indicate disruptive or unauthorized activity.
Severity	High
Tactics	Impact
Techniques	T1529 T1565.001
Required data connectors	CefAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml
Version	1.0.4
Arm template	9a8b4321-e2be-449b-8227-a78227441b2a.json

KQL

ClarotyEvent
| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'
| where EventSeverity == '5'
| project TimeGenerated, DstIpAddr
| extend IPCustomEntity = DstIpAddr

YAML

version: 1.0.4
id: 9a8b4321-e2be-449b-8227-a78227441b2a
relevantTechniques:
- T1529
- T1565.001
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
alertDetailsOverride:
  alertDescriptionFormat: Claroty reported a critical baseline deviation for {{IPCustomEntity}}.
  alertDisplayNameFormat: Claroty critical baseline deviation on {{IPCustomEntity}}
triggerOperator: gt
entityMappings:
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
name: Claroty - Critical baseline deviation
queryFrequency: 1h
triggerThreshold: 0
description: Detects Claroty events where EventOriginalType or EventType indicates a Baseline Deviation and EventSeverity is 5, which represents a critical deviation from baseline that may indicate disruptive or unauthorized activity.
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml
queryPeriod: 1h
severity: High
kind: Scheduled
tactics:
- Impact
query: |-
  ClarotyEvent
  | where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'
  | where EventSeverity == '5'
  | project TimeGenerated, DstIpAddr
  | extend IPCustomEntity = DstIpAddr

ARM