GTI Relevance System Alert - Incident by Alert ID | Microsoft Sentinel Analytic Rules

Back


Id	a1b2c3d4-e5f6-7890-abcd-ef1234567891
Rulename	GTI Relevance System Alert - Incident by Alert ID
Description	Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID. Multiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are grouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps severity from the GTI severity analysis field.
Severity	Medium
Tactics	InitialAccess Reconnaissance Impact CredentialAccess
Techniques	T1566 T1078 T1552 T1486 T1595
Required data connectors	GoogleThreatIntelligenceRelevanceSystemAlertsAPI
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml
Version	1.0.0
Arm template	a1b2c3d4-e5f6-7890-abcd-ef1234567891.json

KQL

GTIRelevanceSystemAlerts
| extend
    SentinelSeverity = case(
        SeverityLevel == "CRITICAL", "High",
        SeverityLevel == "HIGH",     "High",
        SeverityLevel == "MEDIUM",   "Medium",
        SeverityLevel == "LOW",      "Low",
        "Informational"
    ),
    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
| project
    TimeGenerated,
    AlertId,
    AlertName        = DisplayName,
    AlertState       = State,
    DetailType,
    DetailSeverity,
    SeverityLevel,
    SentinelSeverity,
    SeverityConfidence,
    SeverityReasoning,
    PriorityLevel,
    PriorityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    AuditCreateTime,
    AuditUpdateTime

YAML

tactics:
- InitialAccess
- Reconnaissance
- Impact
- CredentialAccess
name: GTI Relevance System Alert - Incident by Alert ID
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml
version: 1.0.0
queryFrequency: 5m
requiredDataConnectors:
- connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
  dataTypes:
  - RelevanceSystemAlerts_CL
customDetails:
  PriorityLevel: PriorityLevel
  DetailSeverity: DetailSeverity
  FindingCount: FindingCount
  AlertId: AlertId
  RelevanceLevel: RelevanceLevel
  DetailType: DetailType
  AlertState: AlertState
id: a1b2c3d4-e5f6-7890-abcd-ef1234567891
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
queryPeriod: 5m
severity: Medium
relevantTechniques:
- T1566
- T1078
- T1552
- T1486
- T1595
alertDetailsOverride:
  alertDescriptionFormat: |
    Alert ID: {{AlertId}}
    Type: {{DetailType}}

    Summary: {{AiSummary}}
  alertSeverityColumnName: SentinelSeverity
  alertDisplayNameFormat: 'GTI Alert: {{AlertName}} [{{AlertState}}]'
description: |
  Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID.
  Multiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are
  grouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps
  severity from the GTI severity analysis field.
triggerOperator: gt
status: Available
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    groupByCustomDetails:
    - AlertId
    matchingMethod: Selected
    lookbackDuration: P5D
    reopenClosedIncident: false
kind: Scheduled
query: |
  GTIRelevanceSystemAlerts
  | extend
      SentinelSeverity = case(
          SeverityLevel == "CRITICAL", "High",
          SeverityLevel == "HIGH",     "High",
          SeverityLevel == "MEDIUM",   "Medium",
          SeverityLevel == "LOW",      "Low",
          "Informational"
      ),
      DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
  | project
      TimeGenerated,
      AlertId,
      AlertName        = DisplayName,
      AlertState       = State,
      DetailType,
      DetailSeverity,
      SeverityLevel,
      SentinelSeverity,
      SeverityConfidence,
      SeverityReasoning,
      PriorityLevel,
      PriorityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      AuditCreateTime,
      AuditUpdateTime

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a1b2c3d4-e5f6-7890-abcd-ef1234567891')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a1b2c3d4-e5f6-7890-abcd-ef1234567891')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Alert ID: {{AlertId}}\nType: {{DetailType}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI Alert: {{AlertName}} [{{AlertState}}]",
          "alertSeverityColumnName": "SentinelSeverity"
        },
        "alertRuleTemplateName": "a1b2c3d4-e5f6-7890-abcd-ef1234567891",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "DetailSeverity": "DetailSeverity",
          "DetailType": "DetailType",
          "FindingCount": "FindingCount",
          "PriorityLevel": "PriorityLevel",
          "RelevanceLevel": "RelevanceLevel"
        },
        "description": "Creates a Microsoft Sentinel incident for each unique Google Threat Intelligence (GTI) Alert ID.\nMultiple ingestion records sharing the same Alert ID (e.g. updated snapshots of the same alert) are\ngrouped into a single incident. The rule surfaces the most recent snapshot of each alert and maps\nseverity from the GTI severity analysis field.\n",
        "displayName": "GTI Relevance System Alert - Incident by Alert ID",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_RelevanceSystemAlerts_IncidentByAlertId.yaml",
        "query": "GTIRelevanceSystemAlerts\n| extend\n    SentinelSeverity = case(\n        SeverityLevel == \"CRITICAL\", \"High\",\n        SeverityLevel == \"HIGH\",     \"High\",\n        SeverityLevel == \"MEDIUM\",   \"Medium\",\n        SeverityLevel == \"LOW\",      \"Low\",\n        \"Informational\"\n    ),\n    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, \"\")\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName        = DisplayName,\n    AlertState       = State,\n    DetailType,\n    DetailSeverity,\n    SeverityLevel,\n    SentinelSeverity,\n    SeverityConfidence,\n    SeverityReasoning,\n    PriorityLevel,\n    PriorityReasoning,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    FindingCount,\n    AiSummary,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Impact",
          "InitialAccess",
          "Reconnaissance"
        ],
        "techniques": [
          "T1078",
          "T1486",
          "T1552",
          "T1566",
          "T1595"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}