HackerView - Any Issue Detected

Back


Id	abe1a663-d00d-482e-aa68-9394622ae03e
Rulename	HackerView - Any Issue Detected
Description	Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
Severity	Informational
Tactics	Reconnaissance Discovery
Techniques	T1592 T1598
Required data connectors	CTM360HackerViewConnectorDefinition
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/HackerViewAnyIssueDetected.yaml
Version	1.0.0
Arm template	abe1a663-d00d-482e-aa68-9394622ae03e.json

KQL

HackerViewLog
| extend RawPayloadDyn = todynamic(RawPayload)
| extend 
  AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
  AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
  IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
  ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
| project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink

YAML

alertDetailsOverride:
  alertDescriptionFormat: HackerView detected {{Severity}} issue {{Title}} on asset {{AssetName}}
  alertDisplayNameFormat: HackerView Alert - {{Title}}
relevantTechniques:
- T1592
- T1598
name: HackerView - Any Issue Detected
queryFrequency: 5m
queryPeriod: 5m
triggerThreshold: 0
severity: Informational
query: |
  HackerViewLog
  | extend RawPayloadDyn = todynamic(RawPayload)
  | extend 
    AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
    AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
    IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
    ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
  | project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink  
tactics:
- Reconnaissance
- Discovery
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/HackerViewAnyIssueDetected.yaml
version: 1.0.0
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: AssetName
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: IpAddress
    identifier: Address
  entityType: IP
requiredDataConnectors:
- connectorId: CTM360HackerViewConnectorDefinition
  dataTypes:
  - HackerViewLog_AzureV2_CL
triggerOperator: GreaterThan
customDetails:
  AssetName: AssetName
  IpAddress: IpAddress
  Severity: Severity
suppressionEnabled: false
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: abe1a663-d00d-482e-aa68-9394622ae03e
suppressionDuration: PT5H
status: Available
description: Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.

ARM