GTI Relevance System Alert - Incident by Alert ID | Microsoft Sentinel Analytic Rules

Back


Id	a1b2c3d4-e5f6-7890-abcd-ef1234567891
Rulename	GTI Relevance System Alert - Incident by Alert ID
Description	Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID. Multiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are grouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps severity from the GTI severity analysis field.
Severity	Medium
Tactics	InitialAccess Reconnaissance Impact CredentialAccess
Techniques	T1566 T1078 T1552 T1486 T1595
Required data connectors	GoogleThreatIntelligenceRelevanceSystemAlertsAPI
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml
Version	1.0.0
Arm template	a1b2c3d4-e5f6-7890-abcd-ef1234567891.json

KQL

GTIRelevanceSystemAlerts
| extend
    SentinelSeverity = case(
        SeverityLevel == "CRITICAL", "High",
        SeverityLevel == "HIGH",     "High",
        SeverityLevel == "MEDIUM",   "Medium",
        SeverityLevel == "LOW",      "Low",
        "Informational"
    ),
    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
| project
    TimeGenerated,
    AlertId,
    AlertName        = DisplayName,
    AlertState       = State,
    DetailType,
    DetailSeverity,
    SeverityLevel,
    SentinelSeverity,
    SeverityConfidence,
    SeverityReasoning,
    PriorityLevel,
    PriorityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    AuditCreateTime,
    AuditUpdateTime

YAML

incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: P5D
    reopenClosedIncident: false
    groupByCustomDetails:
    - AlertId
    matchingMethod: Selected
    enabled: true
  createIncident: true
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml
triggerThreshold: 0
id: a1b2c3d4-e5f6-7890-abcd-ef1234567891
kind: Scheduled
relevantTechniques:
- T1566
- T1078
- T1552
- T1486
- T1595
version: 1.0.0
tactics:
- InitialAccess
- Reconnaissance
- Impact
- CredentialAccess
queryPeriod: 5m
queryFrequency: 5m
alertDetailsOverride:
  alertDescriptionFormat: |
    Alert ID: {{AlertId}}
    Type: {{DetailType}}

    Summary: {{AiSummary}}
  alertSeverityColumnName: SentinelSeverity
  alertDisplayNameFormat: 'GTI Alert: {{AlertName}} [{{AlertState}}]'
severity: Medium
name: GTI Relevance System Alert - Incident by Alert ID
customDetails:
  DetailSeverity: DetailSeverity
  AlertState: AlertState
  RelevanceLevel: RelevanceLevel
  PriorityLevel: PriorityLevel
  FindingCount: FindingCount
  AlertId: AlertId
  DetailType: DetailType
requiredDataConnectors:
- connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
  dataTypes:
  - RelevanceSystemAlerts_CL
description: |
  Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID.
  Multiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are
  grouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps
  severity from the GTI severity analysis field.
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available
query: |
  GTIRelevanceSystemAlerts
  | extend
      SentinelSeverity = case(
          SeverityLevel == "CRITICAL", "High",
          SeverityLevel == "HIGH",     "High",
          SeverityLevel == "MEDIUM",   "Medium",
          SeverityLevel == "LOW",      "Low",
          "Informational"
      ),
      DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
  | project
      TimeGenerated,
      AlertId,
      AlertName        = DisplayName,
      AlertState       = State,
      DetailType,
      DetailSeverity,
      SeverityLevel,
      SentinelSeverity,
      SeverityConfidence,
      SeverityReasoning,
      PriorityLevel,
      PriorityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      AuditCreateTime,
      AuditUpdateTime

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1b2c3d4-e5f6-7890-abcd-ef1234567891')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1b2c3d4-e5f6-7890-abcd-ef1234567891')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Alert ID: {{AlertId}}\nType: {{DetailType}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI Alert: {{AlertName}} [{{AlertState}}]",
          "alertSeverityColumnName": "SentinelSeverity"
        },
        "alertRuleTemplateName": "a1b2c3d4-e5f6-7890-abcd-ef1234567891",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "DetailSeverity": "DetailSeverity",
          "DetailType": "DetailType",
          "FindingCount": "FindingCount",
          "PriorityLevel": "PriorityLevel",
          "RelevanceLevel": "RelevanceLevel"
        },
        "description": "Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID.\nMultiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are\ngrouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps\nseverity from the GTI severity analysis field.\n",
        "displayName": "GTI Relevance System Alert - Incident by Alert ID",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml",
        "query": "GTIRelevanceSystemAlerts\n| extend\n    SentinelSeverity = case(\n        SeverityLevel == \"CRITICAL\", \"High\",\n        SeverityLevel == \"HIGH\",     \"High\",\n        SeverityLevel == \"MEDIUM\",   \"Medium\",\n        SeverityLevel == \"LOW\",      \"Low\",\n        \"Informational\"\n    ),\n    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, \"\")\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName        = DisplayName,\n    AlertState       = State,\n    DetailType,\n    DetailSeverity,\n    SeverityLevel,\n    SentinelSeverity,\n    SeverityConfidence,\n    SeverityReasoning,\n    PriorityLevel,\n    PriorityReasoning,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    FindingCount,\n    AiSummary,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Impact",
          "InitialAccess",
          "Reconnaissance"
        ],
        "techniques": [
          "T1078",
          "T1486",
          "T1552",
          "T1566",
          "T1595"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}