Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Vectra AI Detect - New Campaign Detected

Back
Ida34d0338-eda0-42b5-8b93-32aae0d7a501
RulenameVectra AI Detect - New Campaign Detected
DescriptionIdentifies when a new Campaign has been detected. This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.
SeverityMedium
TacticsLateralMovement
CommandAndControl
Required data connectorsAIVectraDetect
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml
Version1.1.3
Arm templatea34d0338-eda0-42b5-8b93-32aae0d7a501.json
Deploy To Azure
CommonSecurityLog
| where DeviceVendor == "Vectra Networks"
| where DeviceProduct == "X Series"
| where DeviceEventClassID contains "campaign"
| where DeviceAction == "START"
| extend reason = coalesce(
                          column_ifexists("Reason", ""), 
                          extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                          ""
                      )
| project-rename vectra_URL = DeviceCustomString4
| project Activity,SourceHostName, reason, vectra_URL
| extend HostCustomEntity = SourceHostName
severity: Medium
triggerThreshold: 0
query: |
  CommonSecurityLog
  | where DeviceVendor == "Vectra Networks"
  | where DeviceProduct == "X Series"
  | where DeviceEventClassID contains "campaign"
  | where DeviceAction == "START"
  | extend reason = coalesce(
                            column_ifexists("Reason", ""), 
                            extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                            ""
                        )
  | project-rename vectra_URL = DeviceCustomString4
  | project Activity,SourceHostName, reason, vectra_URL
  | extend HostCustomEntity = SourceHostName  
queryFrequency: 1h
requiredDataConnectors:
- connectorId: AIVectraDetect
  dataTypes:
  - CommonSecurityLog
id: a34d0338-eda0-42b5-8b93-32aae0d7a501
version: 1.1.3
name: Vectra AI Detect - New Campaign Detected
kind: Scheduled
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml
queryPeriod: 1h
relevantTechniques: 
triggerOperator: gt
tactics:
- LateralMovement
- CommandAndControl
description: |
    'Identifies when a new Campaign has been detected.  This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: HostCustomEntity
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a34d0338-eda0-42b5-8b93-32aae0d7a501')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a34d0338-eda0-42b5-8b93-32aae0d7a501')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Vectra AI Detect - New Campaign Detected",
        "description": "'Identifies when a new Campaign has been detected.  This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'\n",
        "severity": "Medium",
        "enabled": true,
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Vectra Networks\"\n| where DeviceProduct == \"X Series\"\n| where DeviceEventClassID contains \"campaign\"\n| where DeviceAction == \"START\"\n| extend reason = coalesce(\n                          column_ifexists(\"Reason\", \"\"), \n                          extract(\"reason=(.+?)($|;)\", 1, AdditionalExtensions),\n                          \"\"\n                      )\n| project-rename vectra_URL = DeviceCustomString4\n| project Activity,SourceHostName, reason, vectra_URL\n| extend HostCustomEntity = SourceHostName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "LateralMovement",
          "CommandAndControl"
        ],
        "techniques": null,
        "alertRuleTemplateName": "a34d0338-eda0-42b5-8b93-32aae0d7a501",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "HostCustomEntity",
                "identifier": "HostName"
              }
            ],
            "entityType": "Host"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml",
        "templateVersion": "1.1.3",
        "status": "Available"
      }
    }
  ]
}