HackerView - Any Issue Detected

Back


Id	abe1a663-d00d-482e-aa68-9394622ae03e
Rulename	HackerView - Any Issue Detected
Description	Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
Severity	Informational
Tactics	Reconnaissance Discovery
Techniques	T1592 T1598
Required data connectors	CTM360HackerViewConnectorDefinition
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/HackerViewAnyIssueDetected.yaml
Version	1.0.0
Arm template	abe1a663-d00d-482e-aa68-9394622ae03e.json

KQL

HackerViewLog
| extend RawPayloadDyn = todynamic(RawPayload)
| extend 
  AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
  AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
  IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
  ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
| project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic Rules/HackerViewAnyIssueDetected.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
triggerThreshold: 0
name: HackerView - Any Issue Detected
triggerOperator: GreaterThan
kind: Scheduled
requiredDataConnectors:
- connectorId: CTM360HackerViewConnectorDefinition
  dataTypes:
  - HackerViewLog_AzureV2_CL
queryFrequency: 5m
customDetails:
  IpAddress: IpAddress
  AssetName: AssetName
  Severity: Severity
suppressionDuration: PT5H
queryPeriod: 5m
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: AssetName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IpAddress
suppressionEnabled: false
tactics:
- Reconnaissance
- Discovery
id: abe1a663-d00d-482e-aa68-9394622ae03e
status: Available
version: 1.0.0
query: |
  HackerViewLog
  | extend RawPayloadDyn = todynamic(RawPayload)
  | extend 
    AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
    AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
    IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
    ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
  | project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink  
alertDetailsOverride:
  alertDescriptionFormat: HackerView detected {{Severity}} issue {{Title}} on asset {{AssetName}}
  alertDisplayNameFormat: HackerView Alert - {{Title}}
severity: Informational
relevantTechniques:
- T1592
- T1598

ARM