Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Vectra AI Detect - New Campaign Detected

Back
Ida34d0338-eda0-42b5-8b93-32aae0d7a501
RulenameVectra AI Detect - New Campaign Detected
DescriptionIdentifies when a new Campaign has been detected. This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.
SeverityMedium
TacticsLateralMovement
CommandAndControl
Required data connectorsAIVectraDetect
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml
Version1.1.6
Arm templatea34d0338-eda0-42b5-8b93-32aae0d7a501.json
Deploy To Azure
CommonSecurityLog
| where DeviceVendor == "Vectra Networks"
| where DeviceProduct == "X Series"
| where DeviceEventClassID contains "campaign"
| where DeviceAction == "START"
| extend reason = coalesce(
                          column_ifexists("Reason", ""), 
                          extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                          ""
                      )
| project-rename vectra_URL = DeviceCustomString4
| sort by TimeGenerated
severity: Medium
name: Vectra AI Detect - New Campaign Detected
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: 7d
    enabled: true
    reopenClosedIncident: true
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog
  connectorId: AIVectraDetect
alertDetailsOverride:
  alertDescriptionFormat: |
        A new campaign named {{Activity}} has been detected (reason is {{reason}})
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: vectra_URL
  - alertProperty: ProductName
    value: DeviceProduct
  - alertProperty: ProviderName
    value: DeviceVendor
  alertDisplayNameFormat: Vectra AI - New Campaign Detected
id: a34d0338-eda0-42b5-8b93-32aae0d7a501
tactics:
- LateralMovement
- CommandAndControl
queryFrequency: 5m
triggerOperator: gt
customDetails:
  CampaignName: Activity
  CampaignReason: reason
  CampaignSourceHost: SourceHostName
description: |
    'Identifies when a new Campaign has been detected.  This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'
triggerThreshold: 0
kind: Scheduled
relevantTechniques: 
query: |
  CommonSecurityLog
  | where DeviceVendor == "Vectra Networks"
  | where DeviceProduct == "X Series"
  | where DeviceEventClassID contains "campaign"
  | where DeviceAction == "START"
  | extend reason = coalesce(
                            column_ifexists("Reason", ""), 
                            extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                            ""
                        )
  | project-rename vectra_URL = DeviceCustomString4
  | sort by TimeGenerated  
entityMappings:
- entityType: DNS
  fieldMappings:
  - columnName: Activity
    identifier: DomainName
status: Available
version: 1.1.6
queryPeriod: 5m
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a34d0338-eda0-42b5-8b93-32aae0d7a501')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a34d0338-eda0-42b5-8b93-32aae0d7a501')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Vectra AI Detect - New Campaign Detected",
        "description": "'Identifies when a new Campaign has been detected.  This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Vectra Networks\"\n| where DeviceProduct == \"X Series\"\n| where DeviceEventClassID contains \"campaign\"\n| where DeviceAction == \"START\"\n| extend reason = coalesce(\n                          column_ifexists(\"Reason\", \"\"), \n                          extract(\"reason=(.+?)($|;)\", 1, AdditionalExtensions),\n                          \"\"\n                      )\n| project-rename vectra_URL = DeviceCustomString4\n| sort by TimeGenerated\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "LateralMovement",
          "CommandAndControl"
        ],
        "techniques": null,
        "alertRuleTemplateName": "a34d0338-eda0-42b5-8b93-32aae0d7a501",
        "incidentConfiguration": {
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "P7D",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": true
          },
          "createIncident": true
        },
        "alertDetailsOverride": {
          "alertDescriptionFormat": "A new campaign named {{Activity}} has been detected (reason is {{reason}})\n",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "vectra_URL"
            },
            {
              "alertProperty": "ProductName",
              "value": "DeviceProduct"
            },
            {
              "alertProperty": "ProviderName",
              "value": "DeviceVendor"
            }
          ],
          "alertDisplayNameFormat": "Vectra AI - New Campaign Detected"
        },
        "customDetails": {
          "CampaignName": "Activity",
          "CampaignReason": "reason",
          "CampaignSourceHost": "SourceHostName"
        },
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "DomainName",
                "columnName": "Activity"
              }
            ],
            "entityType": "DNS"
          }
        ],
        "status": "Available",
        "templateVersion": "1.1.6",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml"
      }
    }
  ]
}