union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Network/networkSecurityGroups' //and parse_json(data_data_snapshots_s)[0].region != ''
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot
| extend
id = tostring(snapshot.id),
structure = tostring(snapshot.structure),
reference = tostring(snapshot.reference),
source = tostring(snapshot.source),
collection = tostring(snapshot.collection),
type = tostring(snapshot.type),
region = tostring(snapshot.region),
resourceTypes = tostring(snapshot.resourceTypes),
path = tostring(snapshot.path)
eventGroupingSettings:
aggregationKind: SingleAlert
queryFrequency: 5h
requiredDataConnectors:
- connectorId: PrancerLogData
dataTypes:
- prancer_CL
relevantTechniques:
- T1595
entityMappings:
- entityType: AzureResource
fieldMappings:
- identifier: ResourceId
columnName: path
query: |
union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Network/networkSecurityGroups' //and parse_json(data_data_snapshots_s)[0].region != ''
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot
| extend
id = tostring(snapshot.id),
structure = tostring(snapshot.structure),
reference = tostring(snapshot.reference),
source = tostring(snapshot.source),
collection = tostring(snapshot.collection),
type = tostring(snapshot.type),
region = tostring(snapshot.region),
resourceTypes = tostring(snapshot.resourceTypes),
path = tostring(snapshot.path)
triggerThreshold: 0
customDetails:
alertDetailsOverride:
alertDynamicProperties:
- alertProperty: RemediationSteps
value: data_data_remediation_description_s
alertDisplayNameFormat: '{{data_data_message_s}}'
alertSeverityColumnName: '{{data_data_severity_s}}'
alertDescriptionFormat: '{{data_data_description_s}}'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/Network_Security_Groups_High_Severity.yaml
queryPeriod: 5h
name: NetworkSecurityGroups Alert From Prancer
status: Available
kind: Scheduled
description: |
'High severity network security groups alerts found by Prancer.'
id: a8babf91-b844-477c-8abf-d31e3df74933
version: 1.0.2
triggerOperator: gt
tactics:
- Reconnaissance
severity: High
