Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Guardian- Blocks specific strings of text Policy Violation Detection

Back
Id9c63e0b5-bb83-4873-947a-4385386a6c21
RulenameGuardian- Blocks specific strings of text Policy Violation Detection
DescriptionThis alert creates an incident when Blocks specific strings of text Policy Violation detected from the Guardian.
SeverityLow
Required data connectorsBoschAIShield
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/BlockSubstringVulDetection.yaml
Version1.0.0
Arm template9c63e0b5-bb83-4873-947a-4385386a6c21.json
Deploy To Azure
Guardian
| where PolicyViolatedControlFeature =~ 'Block Substring'
| where Severity =~ 'Low'
queryPeriod: 1h
kind: Scheduled
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.0
name: Guardian- Blocks specific strings of text Policy Violation Detection
relevantTechniques: []
severity: Low
description: |
    'This alert creates an incident when Blocks specific strings of text Policy Violation detected from the Guardian.'
requiredDataConnectors:
- connectorId: BoschAIShield
  dataTypes:
  - Guardian
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'Block Substring'
  | where Severity =~ 'Low'  
tactics: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/BlockSubstringVulDetection.yaml
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: NTDomain
    columnName: NTDomain
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
triggerThreshold: 0
id: 9c63e0b5-bb83-4873-947a-4385386a6c21
triggerOperator: gt
queryFrequency: 1h
status: Available
alertDetailsOverride:
  alertDisplayNameFormat: Guardian- Blocks specific strings of text Policy Violation Detection
  alertSeverityColumnName: Severity
  alertDescriptionFormat: |
        This query detects Blocks specific strings of text Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
  alertTacticsColumnName: 
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9c63e0b5-bb83-4873-947a-4385386a6c21')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9c63e0b5-bb83-4873-947a-4385386a6c21')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "This query detects Blocks specific strings of text Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\\n\\nPlease check the source for more information and investigate further.\n",
          "alertDisplayNameFormat": "Guardian- Blocks specific strings of text Policy Violation Detection",
          "alertSeverityColumnName": "Severity",
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "9c63e0b5-bb83-4873-947a-4385386a6c21",
        "customDetails": null,
        "description": "'This alert creates an incident when Blocks specific strings of text Policy Violation detected from the Guardian.'\n",
        "displayName": "Guardian- Blocks specific strings of text Policy Violation Detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "HostName"
              },
              {
                "columnName": "NTDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/BlockSubstringVulDetection.yaml",
        "query": "Guardian\n| where PolicyViolatedControlFeature =~ 'Block Substring'\n| where Severity =~ 'Low'\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}