HackerView - Any Issue Detected

Back


Id	abe1a663-d00d-482e-aa68-9394622ae03e
Rulename	HackerView - Any Issue Detected
Description	Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
Severity	Informational
Tactics	Reconnaissance Discovery
Techniques	T1592 T1598
Required data connectors	CTM360HackerViewConnectorDefinition
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/HackerViewAnyIssueDetected.yaml
Version	1.0.0
Arm template	abe1a663-d00d-482e-aa68-9394622ae03e.json

KQL

HackerViewLog
| extend RawPayloadDyn = todynamic(RawPayload)
| extend 
  AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
  AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
  IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
  ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
| project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink

YAML

kind: Scheduled
status: Available
triggerThreshold: 0
triggerOperator: GreaterThan
version: 1.0.0
tactics:
- Reconnaissance
- Discovery
alertDetailsOverride:
  alertDisplayNameFormat: HackerView Alert - {{Title}}
  alertDescriptionFormat: HackerView detected {{Severity}} issue {{Title}} on asset {{AssetName}}
suppressionDuration: PT5H
queryFrequency: 5m
id: abe1a663-d00d-482e-aa68-9394622ae03e
requiredDataConnectors:
- connectorId: CTM360HackerViewConnectorDefinition
  dataTypes:
  - HackerViewLog_AzureV2_CL
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques:
- T1592
- T1598
description: Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
customDetails:
  Severity: Severity
  AssetName: AssetName
  IpAddress: IpAddress
suppressionEnabled: false
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: AssetName
    identifier: HostName
- entityType: IP
  fieldMappings:
  - columnName: IpAddress
    identifier: Address
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/HackerViewAnyIssueDetected.yaml
queryPeriod: 5m
name: HackerView - Any Issue Detected
severity: Informational
query: |
  HackerViewLog
  | extend RawPayloadDyn = todynamic(RawPayload)
  | extend 
    AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
    AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
    IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
    ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
  | project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink

ARM