GTI Relevance System Alert - Incident by Alert ID | Microsoft Sentinel Analytic Rules

Back


Id	a1b2c3d4-e5f6-7890-abcd-ef1234567891
Rulename	GTI Relevance System Alert - Incident by Alert ID
Description	Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID. Multiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are grouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps severity from the GTI severity analysis field.
Severity	Medium
Tactics	InitialAccess Reconnaissance Impact CredentialAccess
Techniques	T1566 T1078 T1552 T1486 T1595
Required data connectors	GoogleThreatIntelligenceRelevanceSystemAlertsAPI
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml
Version	1.0.0
Arm template	a1b2c3d4-e5f6-7890-abcd-ef1234567891.json

KQL

GTIRelevanceSystemAlerts
| extend
    SentinelSeverity = case(
        SeverityLevel == "CRITICAL", "High",
        SeverityLevel == "HIGH",     "High",
        SeverityLevel == "MEDIUM",   "Medium",
        SeverityLevel == "LOW",      "Low",
        "Informational"
    ),
    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
| project
    TimeGenerated,
    AlertId,
    AlertName        = DisplayName,
    AlertState       = State,
    DetailType,
    DetailSeverity,
    SeverityLevel,
    SentinelSeverity,
    SeverityConfidence,
    SeverityReasoning,
    PriorityLevel,
    PriorityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    AuditCreateTime,
    AuditUpdateTime

YAML

queryFrequency: 5m
relevantTechniques:
- T1566
- T1078
- T1552
- T1486
- T1595
requiredDataConnectors:
- connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
  dataTypes:
  - RelevanceSystemAlerts_CL
description: |
  Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID.
  Multiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are
  grouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps
  severity from the GTI severity analysis field.
triggerThreshold: 0
id: a1b2c3d4-e5f6-7890-abcd-ef1234567891
queryPeriod: 5m
customDetails:
  AlertState: AlertState
  RelevanceLevel: RelevanceLevel
  AlertId: AlertId
  FindingCount: FindingCount
  DetailType: DetailType
  PriorityLevel: PriorityLevel
  DetailSeverity: DetailSeverity
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: Selected
    reopenClosedIncident: false
    enabled: true
    groupByCustomDetails:
    - AlertId
    lookbackDuration: P5D
  createIncident: true
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Alert: {{AlertName}} [{{AlertState}}]'
  alertSeverityColumnName: SentinelSeverity
  alertDescriptionFormat: |
    Alert ID: {{AlertId}}
    Type: {{DetailType}}

    Summary: {{AiSummary}}
tactics:
- InitialAccess
- Reconnaissance
- Impact
- CredentialAccess
status: Available
version: 1.0.0
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  GTIRelevanceSystemAlerts
  | extend
      SentinelSeverity = case(
          SeverityLevel == "CRITICAL", "High",
          SeverityLevel == "HIGH",     "High",
          SeverityLevel == "MEDIUM",   "Medium",
          SeverityLevel == "LOW",      "Low",
          "Informational"
      ),
      DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
  | project
      TimeGenerated,
      AlertId,
      AlertName        = DisplayName,
      AlertState       = State,
      DetailType,
      DetailSeverity,
      SeverityLevel,
      SentinelSeverity,
      SeverityConfidence,
      SeverityReasoning,
      PriorityLevel,
      PriorityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      AuditCreateTime,
      AuditUpdateTime
severity: Medium
triggerOperator: gt
kind: Scheduled
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml
name: GTI Relevance System Alert - Incident by Alert ID

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1b2c3d4-e5f6-7890-abcd-ef1234567891')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1b2c3d4-e5f6-7890-abcd-ef1234567891')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Alert ID: {{AlertId}}\nType: {{DetailType}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI Alert: {{AlertName}} [{{AlertState}}]",
          "alertSeverityColumnName": "SentinelSeverity"
        },
        "alertRuleTemplateName": "a1b2c3d4-e5f6-7890-abcd-ef1234567891",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "DetailSeverity": "DetailSeverity",
          "DetailType": "DetailType",
          "FindingCount": "FindingCount",
          "PriorityLevel": "PriorityLevel",
          "RelevanceLevel": "RelevanceLevel"
        },
        "description": "Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID.\nMultiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are\ngrouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps\nseverity from the GTI severity analysis field.\n",
        "displayName": "GTI Relevance System Alert - Incident by Alert ID",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml",
        "query": "GTIRelevanceSystemAlerts\n| extend\n    SentinelSeverity = case(\n        SeverityLevel == \"CRITICAL\", \"High\",\n        SeverityLevel == \"HIGH\",     \"High\",\n        SeverityLevel == \"MEDIUM\",   \"Medium\",\n        SeverityLevel == \"LOW\",      \"Low\",\n        \"Informational\"\n    ),\n    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, \"\")\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName        = DisplayName,\n    AlertState       = State,\n    DetailType,\n    DetailSeverity,\n    SeverityLevel,\n    SentinelSeverity,\n    SeverityConfidence,\n    SeverityReasoning,\n    PriorityLevel,\n    PriorityReasoning,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    FindingCount,\n    AiSummary,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Impact",
          "InitialAccess",
          "Reconnaissance"
        ],
        "techniques": [
          "T1078",
          "T1486",
          "T1552",
          "T1566",
          "T1595"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}