GTI Relevance System Alert - Incident by Alert ID | Microsoft Sentinel Analytic Rules

Back


Id	a1b2c3d4-e5f6-7890-abcd-ef1234567891
Rulename	GTI Relevance System Alert - Incident by Alert ID
Description	Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID. Multiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are grouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps severity from the GTI severity analysis field.
Severity	Medium
Tactics	InitialAccess Reconnaissance Impact CredentialAccess
Techniques	T1566 T1078 T1552 T1486 T1595
Required data connectors	GoogleThreatIntelligenceRelevanceSystemAlertsAPI
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml
Version	1.0.0
Arm template	a1b2c3d4-e5f6-7890-abcd-ef1234567891.json

KQL

GTIRelevanceSystemAlerts
| extend
    SentinelSeverity = case(
        SeverityLevel == "CRITICAL", "High",
        SeverityLevel == "HIGH",     "High",
        SeverityLevel == "MEDIUM",   "Medium",
        SeverityLevel == "LOW",      "Low",
        "Informational"
    ),
    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
| project
    TimeGenerated,
    AlertId,
    AlertName        = DisplayName,
    AlertState       = State,
    DetailType,
    DetailSeverity,
    SeverityLevel,
    SentinelSeverity,
    SeverityConfidence,
    SeverityReasoning,
    PriorityLevel,
    PriorityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    AuditCreateTime,
    AuditUpdateTime

YAML

severity: Medium
tactics:
- InitialAccess
- Reconnaissance
- Impact
- CredentialAccess
queryFrequency: 5m
id: a1b2c3d4-e5f6-7890-abcd-ef1234567891
query: |
  GTIRelevanceSystemAlerts
  | extend
      SentinelSeverity = case(
          SeverityLevel == "CRITICAL", "High",
          SeverityLevel == "HIGH",     "High",
          SeverityLevel == "MEDIUM",   "Medium",
          SeverityLevel == "LOW",      "Low",
          "Informational"
      ),
      DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
  | project
      TimeGenerated,
      AlertId,
      AlertName        = DisplayName,
      AlertState       = State,
      DetailType,
      DetailSeverity,
      SeverityLevel,
      SentinelSeverity,
      SeverityConfidence,
      SeverityReasoning,
      PriorityLevel,
      PriorityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      AuditCreateTime,
      AuditUpdateTime
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    lookbackDuration: P5D
    reopenClosedIncident: false
    matchingMethod: Selected
    groupByCustomDetails:
    - AlertId
  createIncident: true
customDetails:
  DetailType: DetailType
  DetailSeverity: DetailSeverity
  AlertState: AlertState
  PriorityLevel: PriorityLevel
  AlertId: AlertId
  RelevanceLevel: RelevanceLevel
  FindingCount: FindingCount
kind: Scheduled
triggerOperator: gt
name: GTI Relevance System Alert - Incident by Alert ID
version: 1.0.0
status: Available
requiredDataConnectors:
- dataTypes:
  - RelevanceSystemAlerts_CL
  connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
description: |
  Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID.
  Multiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are
  grouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps
  severity from the GTI severity analysis field.
relevantTechniques:
- T1566
- T1078
- T1552
- T1486
- T1595
queryPeriod: 5m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Alert: {{AlertName}} [{{AlertState}}]'
  alertSeverityColumnName: SentinelSeverity
  alertDescriptionFormat: |
    Alert ID: {{AlertId}}
    Type: {{DetailType}}

    Summary: {{AiSummary}}

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1b2c3d4-e5f6-7890-abcd-ef1234567891')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1b2c3d4-e5f6-7890-abcd-ef1234567891')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Alert ID: {{AlertId}}\nType: {{DetailType}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI Alert: {{AlertName}} [{{AlertState}}]",
          "alertSeverityColumnName": "SentinelSeverity"
        },
        "alertRuleTemplateName": "a1b2c3d4-e5f6-7890-abcd-ef1234567891",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "DetailSeverity": "DetailSeverity",
          "DetailType": "DetailType",
          "FindingCount": "FindingCount",
          "PriorityLevel": "PriorityLevel",
          "RelevanceLevel": "RelevanceLevel"
        },
        "description": "Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID.\nMultiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are\ngrouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps\nseverity from the GTI severity analysis field.\n",
        "displayName": "GTI Relevance System Alert - Incident by Alert ID",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml",
        "query": "GTIRelevanceSystemAlerts\n| extend\n    SentinelSeverity = case(\n        SeverityLevel == \"CRITICAL\", \"High\",\n        SeverityLevel == \"HIGH\",     \"High\",\n        SeverityLevel == \"MEDIUM\",   \"Medium\",\n        SeverityLevel == \"LOW\",      \"Low\",\n        \"Informational\"\n    ),\n    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, \"\")\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName        = DisplayName,\n    AlertState       = State,\n    DetailType,\n    DetailSeverity,\n    SeverityLevel,\n    SentinelSeverity,\n    SeverityConfidence,\n    SeverityReasoning,\n    PriorityLevel,\n    PriorityReasoning,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    FindingCount,\n    AiSummary,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Impact",
          "InitialAccess",
          "Reconnaissance"
        ],
        "techniques": [
          "T1078",
          "T1486",
          "T1552",
          "T1566",
          "T1595"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}