Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Guardian- Blocks specific strings of text Policy Violation Detection

Back
Id9c63e0b5-bb83-4873-947a-4385386a6c21
RulenameGuardian- Blocks specific strings of text Policy Violation Detection
DescriptionThis alert creates an incident when Blocks specific strings of text Policy Violation detected from the Guardian.
SeverityLow
Required data connectorsBoschAIShield
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/BlockSubstringVulDetection.yaml
Version1.0.0
Arm template9c63e0b5-bb83-4873-947a-4385386a6c21.json
Deploy To Azure
Guardian
| where PolicyViolatedControlFeature =~ 'Block Substring'
| where Severity =~ 'Low'
kind: Scheduled
alertDetailsOverride:
  alertSeverityColumnName: Severity
  alertDisplayNameFormat: Guardian- Blocks specific strings of text Policy Violation Detection
  alertTacticsColumnName: 
  alertDescriptionFormat: |
        This query detects Blocks specific strings of text Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
tactics: []
name: Guardian- Blocks specific strings of text Policy Violation Detection
id: 9c63e0b5-bb83-4873-947a-4385386a6c21
queryFrequency: 1h
severity: Low
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.0
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/BlockSubstringVulDetection.yaml
queryPeriod: 1h
description: |
    'This alert creates an incident when Blocks specific strings of text Policy Violation detected from the Guardian.'
triggerOperator: gt
status: Available
requiredDataConnectors:
- dataTypes:
  - Guardian
  connectorId: BoschAIShield
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'Block Substring'
  | where Severity =~ 'Low'  
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: NTDomain
    identifier: NTDomain
- entityType: IP
  fieldMappings:
  - columnName: SourceIP
    identifier: Address
relevantTechniques: []
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9c63e0b5-bb83-4873-947a-4385386a6c21')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9c63e0b5-bb83-4873-947a-4385386a6c21')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This query detects Blocks specific strings of text Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\\n\\nPlease check the source for more information and investigate further.\n",
          "alertDisplayNameFormat": "Guardian- Blocks specific strings of text Policy Violation Detection",
          "alertSeverityColumnName": "Severity",
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "9c63e0b5-bb83-4873-947a-4385386a6c21",
        "customDetails": null,
        "description": "'This alert creates an incident when Blocks specific strings of text Policy Violation detected from the Guardian.'\n",
        "displayName": "Guardian- Blocks specific strings of text Policy Violation Detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/BlockSubstringVulDetection.yaml",
        "query": "Guardian\n| where PolicyViolatedControlFeature =~ 'Block Substring'\n| where Severity =~ 'Low'\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}