NetworkSecurityGroups Alert From Prancer

Back


Id	a8babf91-b844-477c-8abf-d31e3df74933
Rulename	NetworkSecurityGroups Alert From Prancer
Description	High severity network security groups alerts found by Prancer.
Severity	High
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	PrancerLogData
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Network_Security_Groups_High_Severity.yaml
Version	1.0.2
Arm template	a8babf91-b844-477c-8abf-d31e3df74933.json

KQL

union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Network/networkSecurityGroups' //and parse_json(data_data_snapshots_s)[0].region != ''
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot 
| extend
    id = tostring(snapshot.id),
    structure = tostring(snapshot.structure),
    reference = tostring(snapshot.reference),
    source = tostring(snapshot.source),
    collection = tostring(snapshot.collection),
    type = tostring(snapshot.type),
    region = tostring(snapshot.region),
    resourceTypes = tostring(snapshot.resourceTypes),
    path = tostring(snapshot.path)

YAML

name: NetworkSecurityGroups Alert From Prancer
alertDetailsOverride:
  alertDynamicProperties:
  - value: data_data_remediation_description_s
    alertProperty: RemediationSteps
  alertDisplayNameFormat: '{{data_data_message_s}}'
  alertDescriptionFormat: '{{data_data_description_s}}'
  alertSeverityColumnName: '{{data_data_severity_s}}'
id: a8babf91-b844-477c-8abf-d31e3df74933
description: |
    'High severity network security groups alerts found by Prancer.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: path
    identifier: ResourceId
  entityType: AzureResource
version: 1.0.2
triggerOperator: gt
query: |
  union prancer_CL
  | where deviceProduct_s == 'azure'
  | where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Network/networkSecurityGroups' //and parse_json(data_data_snapshots_s)[0].region != ''
  | where data_data_severity_s == 'High' and data_data_result_s == 'failed'
  | extend snapshot = parse_json(data_data_snapshots_s)
  | mv-expand snapshot 
  | extend
      id = tostring(snapshot.id),
      structure = tostring(snapshot.structure),
      reference = tostring(snapshot.reference),
      source = tostring(snapshot.source),
      collection = tostring(snapshot.collection),
      type = tostring(snapshot.type),
      region = tostring(snapshot.region),
      resourceTypes = tostring(snapshot.resourceTypes),
      path = tostring(snapshot.path)  
tactics:
- Reconnaissance
kind: Scheduled
queryFrequency: 5h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Network_Security_Groups_High_Severity.yaml
severity: High
queryPeriod: 5h
requiredDataConnectors:
- dataTypes:
  - prancer_CL
  connectorId: PrancerLogData
status: Available
customDetails: 
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1595

ARM