Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

ARGOS Cloud Security - Exploitable Cloud Resources

Back
Ida9bf1b8c-c761-4840-b9a8-7535ca68ca28
RulenameARGOS Cloud Security - Exploitable Cloud Resources
DescriptionExploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.
SeverityHigh
TacticsInitialAccess
Required data connectorsARGOSCloudSecurity
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ARGOSCloudSecurity/Analytic Rules/ExploitableSecurityIssues.yaml
Version1.0.2
Arm templatea9bf1b8c-c761-4840-b9a8-7535ca68ca28.json
Deploy To Azure
ARGOS_CL | where exploitable_b
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    enabled: false
    lookbackDuration: PT5H
alertRuleTemplateName: 
version: 1.0.2
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: ARGOS Cloud Security - Exploitable Cloud Resources
queryPeriod: 1h
alertDetailsOverride:
  alertDisplayNameFormat: New exploitable cloud resource - {{name_s}} - {{ruleId_s}}
kind: Scheduled
requiredDataConnectors:
- connectorId: ARGOSCloudSecurity
  dataTypes:
  - ARGOS_CL
suppressionEnabled: false
severity: High
entityMappings:
- entityType: AzureResource
  fieldMappings:
  - columnName: ResourceId
    identifier: ResourceId
- entityType: URL
  fieldMappings:
  - columnName: url_s
    identifier: Url
query: |
    ARGOS_CL | where exploitable_b
tactics:
- InitialAccess
description: Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.
triggerOperator: gt
customDetails: 
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ARGOSCloudSecurity/Analytic Rules/ExploitableSecurityIssues.yaml
techniques: []
suppressionDuration: PT5H
status: Available
queryFrequency: 1h
id: a9bf1b8c-c761-4840-b9a8-7535ca68ca28
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/a9bf1b8c-c761-4840-b9a8-7535ca68ca28')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/a9bf1b8c-c761-4840-b9a8-7535ca68ca28')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "ARGOS Cloud Security - Exploitable Cloud Resources",
        "description": "Exploitable Cloud Security Issues are ones that expose cloud resources to the internet and allow initial access to your environment.",
        "severity": "High",
        "enabled": true,
        "query": "ARGOS_CL | where exploitable_b\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "InitialAccess"
        ],
        "techniques": [],
        "alertRuleTemplateName": null,
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false,
            "enabled": false,
            "lookbackDuration": "PT5H"
          }
        },
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "alertDetailsOverride": {
          "alertDisplayNameFormat": "New exploitable cloud resource - {{name_s}} - {{ruleId_s}}"
        },
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "ResourceId",
                "identifier": "ResourceId"
              }
            ],
            "entityType": "AzureResource"
          },
          {
            "fieldMappings": [
              {
                "columnName": "url_s",
                "identifier": "Url"
              }
            ],
            "entityType": "URL"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ARGOSCloudSecurity/Analytic Rules/ExploitableSecurityIssues.yaml",
        "templateVersion": "1.0.2",
        "status": "Available"
      }
    }
  ]
}