Illumio VEN Clone Detection Rule

Back


Id	b3c4b8f4-c12c-471e-9999-023c05852276
Rulename	Illumio VEN Clone Detection Rule
Description	Create Microsoft Sentinel Incident When A Cloned Ven Is Detected
Severity	High
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	IllumioSaaSDataConnector SyslogAma
Kind	Scheduled
Query frequency	60m
Query period	60m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml
Version	1.0.6
Arm template	b3c4b8f4-c12c-471e-9999-023c05852276.json

KQL

Illumio_Auditable_Events_CL
| union IllumioSyslogAuditEvents  
| where event_type has 'agent.clone_detected'
| extend hostname = created_by.agent.hostname,
        ven_href = created_by.ven.href

YAML

name: Illumio VEN Clone Detection Rule
alertDetailsOverride:
  alertDisplayNameFormat: |
        Illumio VEN Clone Detection Incident for {{hostname}}
  alertDescriptionFormat: |
        Illumio VEN Clone Detection for {{hostname}} generated at {{TimeGenerated}}
id: b3c4b8f4-c12c-471e-9999-023c05852276
description: |
    'Create Microsoft Sentinel Incident When A Cloned Ven Is Detected'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: hostname
    identifier: HostName
  entityType: Host
version: 1.0.6
triggerOperator: gt
query: |
  Illumio_Auditable_Events_CL
  | union IllumioSyslogAuditEvents  
  | where event_type has 'agent.clone_detected'
  | extend hostname = created_by.agent.hostname,
          ven_href = created_by.ven.href  
tactics:
- DefenseEvasion
kind: Scheduled
queryFrequency: 60m
severity: High
queryPeriod: 60m
requiredDataConnectors:
- dataTypes:
  - Illumio_Auditable_Events_CL
  connectorId: IllumioSaaSDataConnector
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml
eventGroupingSettings:
  aggregationKind: SingleAlert
relevantTechniques:
- T1562

ARM