CyberBlindSpot - Any Issue Detected

Back


Id	abe1a662-d00d-482e-aa68-9394622ae02e
Rulename	CyberBlindSpot - Any Issue Detected
Description	Generic alert that triggers when ANY CyberBlindSpot issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
Severity	Informational
Tactics	Reconnaissance Discovery ResourceDevelopment InitialAccess
Techniques	T1592 T1598 T1566
Required data connectors	CTM360CBSConnectorDefinition
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/CBSAnyIssueDetected.yaml
Version	1.0.0
Arm template	abe1a662-d00d-482e-aa68-9394622ae02e.json

KQL

CBSLog
| project TimeGenerated, IncidentId, Subject, Severity, IncidentType, Status, Class, ExternalLink, Brand, FirstSeen, LastSeen, Remarks

YAML

alertDetailsOverride:
  alertDescriptionFormat: Type {{IncidentType}} | Subject {{Subject}} | Severity {{Severity}}
  alertDisplayNameFormat: CyberBlindSpot Alert - {{IncidentType}} on {{Subject}} - {{Brand}}
relevantTechniques:
- T1592
- T1598
- T1566
name: CyberBlindSpot - Any Issue Detected
queryFrequency: 5m
queryPeriod: 5m
triggerThreshold: 0
severity: Informational
query: |
  CBSLog
  | project TimeGenerated, IncidentId, Subject, Severity, IncidentType, Status, Class, ExternalLink, Brand, FirstSeen, LastSeen, Remarks  
tactics:
- Reconnaissance
- Discovery
- ResourceDevelopment
- InitialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/CBSAnyIssueDetected.yaml
version: 1.0.0
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: Subject
    identifier: Url
  entityType: URL
requiredDataConnectors:
- connectorId: CTM360CBSConnectorDefinition
  dataTypes:
  - CBS_MalwareLogs_AzureV2_CL
  - CBS_BreachedCredentials_AzureV2_CL
  - CBS_CompromisedCards_AzureV2_CL
  - CBS_DomainInfringement_AzureV2_CL
  - CBS_SubdomainInfringement_AzureV2_CL
  - CBSLog_AzureV2_CL
triggerOperator: GreaterThan
customDetails:
  Brand: Brand
  Subject: Subject
  IncidentType: IncidentType
suppressionEnabled: false
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: abe1a662-d00d-482e-aa68-9394622ae02e
suppressionDuration: PT5H
status: Available
description: Generic alert that triggers when ANY CyberBlindSpot issue/incident is detected in the logs. Extracts nested metadata from RawPayload.

ARM