ARGOS Cloud Security - Exploitable Cloud Resources | Microsoft Sentinel Analytic Rules

Back


Id	a9bf1b8c-c761-4840-b9a8-7535ca68ca28
Rulename	ARGOS Cloud Security - Exploitable Cloud Resources
Description	Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.
Severity	High
Tactics	InitialAccess
Techniques	T1190
Required data connectors	ARGOSCloudSecurity
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ARGOSCloudSecurity/Analytic%20Rules/ExploitableSecurityIssues.yaml
Version	1.0.3
Arm template	a9bf1b8c-c761-4840-b9a8-7535ca68ca28.json

KQL

ARGOS_CL | where exploitable_b

YAML

suppressionDuration: PT5H
name: ARGOS Cloud Security - Exploitable Cloud Resources
suppressionEnabled: false
triggerOperator: gt
query: |
  ARGOS_CL | where exploitable_b
queryFrequency: 1h
description: Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.
id: a9bf1b8c-c761-4840-b9a8-7535ca68ca28
triggerThreshold: 0
queryPeriod: 1h
version: 1.0.3
kind: Scheduled
customDetails: 
status: Available
alertRuleTemplateName: 
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: ARGOSCloudSecurity
  dataTypes:
  - ARGOS_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ARGOSCloudSecurity/Analytic%20Rules/ExploitableSecurityIssues.yaml
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
  createIncident: true
alertDetailsOverride:
  alertDisplayNameFormat: New exploitable cloud resource - {{name_s}} - {{ruleId_s}}
relevantTechniques:
- T1190
tactics:
- InitialAccess
entityMappings:
- fieldMappings:
  - identifier: ResourceId
    columnName: ResourceId
  entityType: AzureResource
- fieldMappings:
  - identifier: Url
    columnName: url_s
  entityType: URL

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a9bf1b8c-c761-4840-b9a8-7535ca68ca28')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a9bf1b8c-c761-4840-b9a8-7535ca68ca28')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDisplayNameFormat": "New exploitable cloud resource - {{name_s}} - {{ruleId_s}}"
        },
        "alertRuleTemplateName": "a9bf1b8c-c761-4840-b9a8-7535ca68ca28",
        "customDetails": null,
        "description": "Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.",
        "displayName": "ARGOS Cloud Security - Exploitable Cloud Resources",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "columnName": "ResourceId",
                "identifier": "ResourceId"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "url_s",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ARGOSCloudSecurity/Analytic%20Rules/ExploitableSecurityIssues.yaml",
        "query": "ARGOS_CL | where exploitable_b\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [
          "T1190"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}