Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Dynatrace Application Security - Third-Party runtime vulnerability detection

Back
Idaf99b078-124b-543a-9a50-66ef87c09f6a
RulenameDynatrace Application Security - Third-Party runtime vulnerability detection
DescriptionDetect Third-Party runtime vulnerabilities in your environment insights by snyk
SeverityMedium
TacticsDefenseEvasion
Execution
Impact
InitialAccess
LateralMovement
Persistence
PrivilegeEscalation
Required data connectorsDynatraceRuntimeVulnerabilities
KindScheduled
Query frequency1d
Query period1d
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_ThirdPartyVulnerabilityDetection.yaml
Version1.0.2
Arm templateaf99b078-124b-543a-9a50-66ef87c09f6a.json
Deploy To Azure
DynatraceSecurityProblems
| where VulnerabilityType != "CODE_LEVEL" and DAVISRiskLevel == "CRITICAL"  and Muted == false
| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId
version: 1.0.2
triggerThreshold: 0
name: Dynatrace Application Security - Third-Party runtime vulnerability detection
id: af99b078-124b-543a-9a50-66ef87c09f6a
alertDetailsOverride:
  alertDisplayNameFormat: 'Dynatrace Third-party runtime vulnerability detected - {{DisplayId}} : {{Title}}'
  alertSeverityColumnName: Severity
  alertDescriptionFormat: |
        Third-party runtime vulnerability ({{ExternalVulnerabilityId}}) detected in package ({{PackageName}}), more details available from Dynatrace at {{Url}}.
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
kind: Scheduled
severity: Medium
status: Available
description: |
    'Detect Third-Party runtime vulnerabilities in your environment insights by snyk'
queryFrequency: 1d
requiredDataConnectors:
- dataTypes:
  - DynatraceSecurityProblems
  connectorId: DynatraceRuntimeVulnerabilities
queryPeriod: 1d
customDetails:
  Technology: Technology
  DAVISPublicExploit: DAVISPublicExploit
  PackageName: PackageName
  DAVISRiskVector: DAVISRiskVector
  DAVISRiskLevel: DAVISRiskLevel
  DAVISRiskScore: DAVISRiskScore
  ExternVulnIdentifier: ExternalVulnerabilityId
  VulnerabilityType: VulnerabilityType
  CVEIds: CVEIds
  DAVISVulnFuncUsage: DAVISVulnerableFunctionUsage
  SecProbIdentifier: SecurityProblemId
  DAVISExposure: DAVISExposure
  DisplayIdentifier: DisplayId
  DAVISDataAssets: DAVISDataAssets
  SecurityProblemUrl: Url
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  DynatraceSecurityProblems
  | where VulnerabilityType != "CODE_LEVEL" and DAVISRiskLevel == "CRITICAL"  and Muted == false
  | summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId  
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: Url
  entityType: URL
triggerOperator: gt
tactics:
- DefenseEvasion
- Execution
- Impact
- InitialAccess
- LateralMovement
- Persistence
- PrivilegeEscalation
requiredTechniques:
- T1140
- T1059
- T1565
- T1659
- T1210
- T1554
- T1548
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_ThirdPartyVulnerabilityDetection.yaml
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/af99b078-124b-543a-9a50-66ef87c09f6a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/af99b078-124b-543a-9a50-66ef87c09f6a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Third-party runtime vulnerability ({{ExternalVulnerabilityId}}) detected in package ({{PackageName}}), more details available from Dynatrace at {{Url}}.\n",
          "alertDisplayNameFormat": "Dynatrace Third-party runtime vulnerability detected - {{DisplayId}} : {{Title}}",
          "alertSeverityColumnName": "Severity"
        },
        "alertRuleTemplateName": "af99b078-124b-543a-9a50-66ef87c09f6a",
        "customDetails": {
          "CVEIds": "CVEIds",
          "DAVISDataAssets": "DAVISDataAssets",
          "DAVISExposure": "DAVISExposure",
          "DAVISPublicExploit": "DAVISPublicExploit",
          "DAVISRiskLevel": "DAVISRiskLevel",
          "DAVISRiskScore": "DAVISRiskScore",
          "DAVISRiskVector": "DAVISRiskVector",
          "DAVISVulnFuncUsage": "DAVISVulnerableFunctionUsage",
          "DisplayIdentifier": "DisplayId",
          "ExternVulnIdentifier": "ExternalVulnerabilityId",
          "PackageName": "PackageName",
          "SecProbIdentifier": "SecurityProblemId",
          "SecurityProblemUrl": "Url",
          "Technology": "Technology",
          "VulnerabilityType": "VulnerabilityType"
        },
        "description": "'Detect Third-Party runtime vulnerabilities in your environment insights by snyk'\n",
        "displayName": "Dynatrace Application Security - Third-Party runtime vulnerability detection",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "Url",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": false,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Dynatrace/Analytic Rules/DynatraceApplicationSecurity_ThirdPartyVulnerabilityDetection.yaml",
        "query": "DynatraceSecurityProblems\n| where VulnerabilityType != \"CODE_LEVEL\" and DAVISRiskLevel == \"CRITICAL\"  and Muted == false\n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n",
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "requiredTechniques": [
          "T1140",
          "T1059",
          "T1565",
          "T1659",
          "T1210",
          "T1554",
          "T1548"
        ],
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution",
          "Impact",
          "InitialAccess",
          "LateralMovement",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}