Vaikora - High severity security alerts

Back


Id	ac3ec787-fd49-4e93-88cc-aaa9b31061ac
Rulename	Vaikora - High severity security alerts
Description	Identifies high or critical severity security alerts ingested from Vaikora in the last 6 hours, indicating active threats such as malware activity, intrusion attempts, or policy violations.
Severity	High
Tactics	InitialAccess Execution Persistence DefenseEvasion CredentialAccess Discovery LateralMovement Collection CommandAndControl Exfiltration Impact
Required data connectors	VaikoraSecurityCenter
Kind	Scheduled
Query frequency	6h
Query period	6h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-AzureSecurityCenter/Analytic Rules/Vaikora - High Severity Security Alerts.yaml
Version	1.0.0
Arm template	ac3ec787-fd49-4e93-88cc-aaa9b31061ac.json

KQL

Vaikora_SecurityAlerts_CL
| where TimeGenerated >= ago(6h)
| where Severity_s in ("high", "critical")
| extend
    AlertId       = AlertId_s,
    AgentId       = AgentId_s,
    ActionType    = ActionType_s,
    Severity      = Severity_s,
    Title         = Title_s,
    Description   = Description_s,
    SourceIP      = SourceIP,
    DestinationIP = DestinationIP_s,
    SourceHost    = SourceHost_s,
    DestHost      = DestinationHost_s,
    ProcessName   = ProcessName_s,
    UserName      = UserName_s,
    FilePath      = FilePath_s,
    Confidence    = ConfidenceScore_d,
    ThreatFlag    = ThreatDetected_b,
    AnomalyFlag   = IsAnomaly_b
| project
    TimeGenerated, AlertId, AgentId, ActionType, Severity, Title, Description,
    SourceIP, DestinationIP, SourceHost, DestHost, ProcessName, UserName, FilePath,
    Confidence, ThreatFlag, AnomalyFlag
| order by TimeGenerated desc

YAML

description: |
    Identifies high or critical severity security alerts ingested from Vaikora in the last 6 hours, indicating active threats such as malware activity, intrusion attempts, or policy violations.
kind: Scheduled
alertDetailsOverride:
  alertSeverityColumnName: Severity_s
  alertDisplayNameFormat: 'Vaikora {{Severity_s}} Alert: {{Title_s}}'
  alertDescriptionFormat: Vaikora detected a {{Severity_s}} severity event on agent {{AgentId_s}}. {{Description_s}}
query: |
  Vaikora_SecurityAlerts_CL
  | where TimeGenerated >= ago(6h)
  | where Severity_s in ("high", "critical")
  | extend
      AlertId       = AlertId_s,
      AgentId       = AgentId_s,
      ActionType    = ActionType_s,
      Severity      = Severity_s,
      Title         = Title_s,
      Description   = Description_s,
      SourceIP      = SourceIP,
      DestinationIP = DestinationIP_s,
      SourceHost    = SourceHost_s,
      DestHost      = DestinationHost_s,
      ProcessName   = ProcessName_s,
      UserName      = UserName_s,
      FilePath      = FilePath_s,
      Confidence    = ConfidenceScore_d,
      ThreatFlag    = ThreatDetected_b,
      AnomalyFlag   = IsAnomaly_b
  | project
      TimeGenerated, AlertId, AgentId, ActionType, Severity, Title, Description,
      SourceIP, DestinationIP, SourceHost, DestHost, ProcessName, UserName, FilePath,
      Confidence, ThreatFlag, AnomalyFlag
  | order by TimeGenerated desc  
requiredDataConnectors:
- connectorId: VaikoraSecurityCenter
  dataTypes:
  - Vaikora_SecurityAlerts_CL
version: 1.0.0
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: SourceIP
  entityType: IP
- fieldMappings:
  - identifier: Address
    columnName: DestinationIP
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: SourceHost
  entityType: Host
- fieldMappings:
  - identifier: Name
    columnName: UserName
  entityType: Account
- fieldMappings:
  - identifier: ProcessId
    columnName: ProcessName
  entityType: Process
triggerOperator: gt
id: ac3ec787-fd49-4e93-88cc-aaa9b31061ac
triggerThreshold: 0
tactics:
- InitialAccess
- Execution
- Persistence
- DefenseEvasion
- CredentialAccess
- Discovery
- LateralMovement
- Collection
- CommandAndControl
- Exfiltration
- Impact
name: Vaikora - High severity security alerts
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vaikora-AzureSecurityCenter/Analytic Rules/Vaikora - High Severity Security Alerts.yaml
status: Available
queryFrequency: 6h
queryPeriod: 6h
relevantTechniques: []
severity: High

ARM