ARGOS Cloud Security - Exploitable Cloud Resources

Back


Id	a9bf1b8c-c761-4840-b9a8-7535ca68ca28
Rulename	ARGOS Cloud Security - Exploitable Cloud Resources
Description	Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.
Severity	High
Tactics	InitialAccess
Techniques	T1190
Required data connectors	ARGOSCloudSecurity
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ARGOSCloudSecurity/Analytic Rules/ExploitableSecurityIssues.yaml
Version	1.0.3
Arm template	a9bf1b8c-c761-4840-b9a8-7535ca68ca28.json

KQL

ARGOS_CL | where exploitable_b

YAML

description: Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.
version: 1.0.3
queryFrequency: 1h
triggerThreshold: 0
tactics:
- InitialAccess
alertRuleTemplateName: 
suppressionEnabled: false
suppressionDuration: PT5H
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ARGOSCloudSecurity/Analytic Rules/ExploitableSecurityIssues.yaml
entityMappings:
- fieldMappings:
  - columnName: ResourceId
    identifier: ResourceId
  entityType: AzureResource
- fieldMappings:
  - columnName: url_s
    identifier: Url
  entityType: URL
query: |
    ARGOS_CL | where exploitable_b
status: Available
alertDetailsOverride:
  alertDisplayNameFormat: New exploitable cloud resource - {{name_s}} - {{ruleId_s}}
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: a9bf1b8c-c761-4840-b9a8-7535ca68ca28
name: ARGOS Cloud Security - Exploitable Cloud Resources
triggerOperator: gt
severity: High
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    lookbackDuration: PT5H
    enabled: false
    matchingMethod: AllEntities
kind: Scheduled
customDetails: 
relevantTechniques:
- T1190
requiredDataConnectors:
- dataTypes:
  - ARGOS_CL
  connectorId: ARGOSCloudSecurity

ARM