HackerView - Any Issue Detected

HackerViewLog
| extend RawPayloadDyn = todynamic(RawPayload)
| extend 
  AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
  AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
  IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
  ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
| project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink

triggerThreshold: 0
suppressionDuration: PT5H
queryPeriod: 5m
kind: Scheduled
description: Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
version: 1.0.0
queryFrequency: 5m
relevantTechniques:
- T1592
- T1598
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: AssetName
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: IpAddress
  entityType: IP
id: abe1a663-d00d-482e-aa68-9394622ae03e
triggerOperator: GreaterThan
query: |
  HackerViewLog
  | extend RawPayloadDyn = todynamic(RawPayload)
  | extend 
    AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),
    AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),
    IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),
    ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))
  | project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: HackerView Alert - {{Title}}
  alertDescriptionFormat: HackerView detected {{Severity}} issue {{Title}} on asset {{AssetName}}
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic%20Rules/HackerViewAnyIssueDetected.yaml
suppressionEnabled: false
requiredDataConnectors:
- dataTypes:
  - HackerViewLog_AzureV2_CL
  connectorId: CTM360HackerViewConnectorDefinition
customDetails:
  Severity: Severity
  IpAddress: IpAddress
  AssetName: AssetName
tactics:
- Reconnaissance
- Discovery
severity: Informational
status: Available
name: HackerView - Any Issue Detected

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/abe1a663-d00d-482e-aa68-9394622ae03e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/abe1a663-d00d-482e-aa68-9394622ae03e')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "HackerView detected {{Severity}} issue {{Title}} on asset {{AssetName}}",
          "alertDisplayNameFormat": "HackerView Alert - {{Title}}"
        },
        "alertRuleTemplateName": "abe1a663-d00d-482e-aa68-9394622ae03e",
        "customDetails": {
          "AssetName": "AssetName",
          "IpAddress": "IpAddress",
          "Severity": "Severity"
        },
        "description": "Generic alert that triggers when ANY HackerView issue/incident is detected in the logs. Extracts nested metadata from RawPayload.",
        "displayName": "HackerView - Any Issue Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "AssetName",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IpAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CTM360/Analytic%20Rules/HackerViewAnyIssueDetected.yaml",
        "query": "HackerViewLog\n| extend RawPayloadDyn = todynamic(RawPayload)\n| extend \n  AssetName = coalesce(AssetName, tostring(RawPayloadDyn.meta.asset), tostring(RawPayloadDyn.meta.host)),\n  AssetType = coalesce(AssetType, tostring(RawPayloadDyn.meta.asset_type)),\n  IpAddress = coalesce(IpAddress, tostring(RawPayloadDyn.meta.resolved_ip)),\n  ExternalLink = coalesce(ExternalLink, tostring(RawPayloadDyn.hackerview_link))\n| project TimeGenerated, Title, Severity, AssetName, AssetType, IpAddress, ExternalLink\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Informational",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "Reconnaissance"
        ],
        "techniques": [
          "T1592",
          "T1598"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}