Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Sonrai Ticket Updated

Back
Idaf9b8eb1-a8ef-40aa-92a4-1fc73a1479c7
RulenameSonrai Ticket Updated
DescriptionChecks if Sonrai tickets have been updated.

It uses the action type to check if a ticket has been updated
SeverityMedium
TacticsCollection
CommandAndControl
CredentialAccess
DefenseEvasion
Discovery
Execution
Exfiltration
Impact
InitialAccess
LateralMovement
Persistence
PrivilegeEscalation
TechniquesT1566
T1059
T1547
T1548
T1562
T1003
T1087
T1021
T1119
T1071
T1041
T1499
Required data connectorsSonraiDataConnector
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic Rules/SonraiTicketUpdated.yaml
Version1.0.2
Arm templateaf9b8eb1-a8ef-40aa-92a4-1fc73a1479c7.json
Deploy To Azure
Sonrai_Tickets_CL
| where action_d == 5
tactics:
- Collection
- CommandAndControl
- CredentialAccess
- DefenseEvasion
- Discovery
- Execution
- Exfiltration
- Impact
- InitialAccess
- LateralMovement
- Persistence
- PrivilegeEscalation
relevantTechniques:
- T1566
- T1059
- T1547
- T1548
- T1562
- T1003
- T1087
- T1021
- T1119
- T1071
- T1041
- T1499
id: af9b8eb1-a8ef-40aa-92a4-1fc73a1479c7
severity: Medium
status: Available
name: Sonrai Ticket Updated
eventGroupingSettings:
  aggregationKind: AlertPerResult
requiredDataConnectors:
- connectorId: SonraiDataConnector
  dataTypes:
  - Sonrai_Tickets_CL
query: |
  Sonrai_Tickets_CL
  | where action_d == 5  
alertDetailsOverride:
  alertDisplayNameFormat: Updated - {{digest_ticketSrn_s}} - {{digest_ticketKeyName_s}}
  alertSeverityColumnName: digest_severityCategory_s
  alertDescriptionFormat: digest_ticketKeyDescription_s
queryPeriod: 5m
entityMappings:
- entityType: CloudApplication
  fieldMappings:
  - identifier: Name
    columnName: digest_criticalResourceName_s
triggerOperator: gt
triggerThreshold: 0
description: |
  'Checks if Sonrai tickets have been updated. 
  It uses the action type to check if a ticket has been updated'  
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic Rules/SonraiTicketUpdated.yaml
queryFrequency: 5m
kind: Scheduled
customDetails:
  ticketStatus: digest_status_s
  ticketName: digest_title_s
  resourceType: digest_resourceType_s
  ticketSeverity: digest_severityCategory_s
  criticalResource: digest_criticalResourceName_s
  resourceLabel: digest_resourceLabel_s
  ticketOrg: digest_org_s
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/af9b8eb1-a8ef-40aa-92a4-1fc73a1479c7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/af9b8eb1-a8ef-40aa-92a4-1fc73a1479c7')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "digest_ticketKeyDescription_s",
          "alertDisplayNameFormat": "Updated - {{digest_ticketSrn_s}} - {{digest_ticketKeyName_s}}",
          "alertSeverityColumnName": "digest_severityCategory_s"
        },
        "alertRuleTemplateName": "af9b8eb1-a8ef-40aa-92a4-1fc73a1479c7",
        "customDetails": {
          "criticalResource": "digest_criticalResourceName_s",
          "resourceLabel": "digest_resourceLabel_s",
          "resourceType": "digest_resourceType_s",
          "ticketName": "digest_title_s",
          "ticketOrg": "digest_org_s",
          "ticketSeverity": "digest_severityCategory_s",
          "ticketStatus": "digest_status_s"
        },
        "description": "'Checks if Sonrai tickets have been updated. \nIt uses the action type to check if a ticket has been updated'\n",
        "displayName": "Sonrai Ticket Updated",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "digest_criticalResourceName_s",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SonraiSecurity/Analytic Rules/SonraiTicketUpdated.yaml",
        "query": "Sonrai_Tickets_CL\n| where action_d == 5\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CommandAndControl",
          "CredentialAccess",
          "DefenseEvasion",
          "Discovery",
          "Execution",
          "Exfiltration",
          "Impact",
          "InitialAccess",
          "LateralMovement",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1003",
          "T1021",
          "T1041",
          "T1059",
          "T1071",
          "T1087",
          "T1119",
          "T1499",
          "T1547",
          "T1548",
          "T1562",
          "T1566"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}