XbowMediumFindings | Microsoft Sentinel Analytic Rules

Back


Id	b3c5e2f9-6a8d-4127-9b2e-4f6a8c9d0e12
Rulename	XbowMediumFindings
Description	Creates an incident for each Medium severity finding reported by XBOW that is currently in an open state. These findings represent moderate security risks that should be addressed in a timely manner. Each alert is deduplicated per finding so re-ingestion of the same finding does not produce duplicate incidents.
Severity	Medium
Tactics	Discovery Reconnaissance CredentialAccess
Required data connectors	XbowSecurityConnector
Kind	Scheduled
Query frequency	30m
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowMediumFindings.yaml
Version	1.0.1
Arm template	b3c5e2f9-6a8d-4127-9b2e-4f6a8c9d0e12.json

KQL

XbowFindings_CL
| where TimeGenerated > ago(1h)
| where tolower(Severity) == 'medium'
| where isempty(State) or tolower(State) == 'open'
| summarize arg_max(TimeGenerated, *) by FindingId
| join kind=leftouter (
    XbowAssets_CL
    | summarize arg_max(TimeGenerated, *) by AssetId
    | project AssetId, StartUrl
) on AssetId
| project
    TimeGenerated,
    FindingId,
    FindingName,
    Severity,
    State,
    Summary,
    Impact,
    Mitigations,
    Recipe,
    AssetId,
    AssetName,
    OrganizationId,
    CreatedAt,
    StartUrl

YAML

status: Available
triggerThreshold: 0
relevantTechniques: []
queryPeriod: 1h
tactics:
- Discovery
- Reconnaissance
- CredentialAccess
name: XbowMediumFindings
customDetails:
  AssetID: AssetId
  FindingID: FindingId
  State: State
  CreatedAt: CreatedAt
  FindingName: FindingName
  Severity: Severity
  AssetName: AssetName
  OrganizationID: OrganizationId
  Mitigations: Mitigations
description: |
  Creates an incident for each Medium severity finding reported by XBOW that is currently
  in an open state. These findings represent moderate security risks that should be
  addressed in a timely manner. Each alert is deduplicated per finding so re-ingestion
  of the same finding does not produce duplicate incidents.
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowMediumFindings.yaml
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: StartUrl
    identifier: Url
  entityType: URL
alertDetailsOverride:
  alertDescriptionFormat: Medium severity finding on asset {{AssetName}} ({{AssetId}}). {{Summary}}
  alertDisplayNameFormat: 'XBOW Medium: {{FindingName}}'
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: Selected
    reopenClosedIncident: false
    lookbackDuration: 24h
    groupByCustomDetails:
    - FindingID
    enabled: true
  createIncident: true
triggerOperator: gt
id: b3c5e2f9-6a8d-4127-9b2e-4f6a8c9d0e12
severity: Medium
version: 1.0.1
requiredDataConnectors:
- connectorId: XbowSecurityConnector
  dataTypes:
  - XbowFindings_CL
  - XbowAssets_CL
query: |
  XbowFindings_CL
  | where TimeGenerated > ago(1h)
  | where tolower(Severity) == 'medium'
  | where isempty(State) or tolower(State) == 'open'
  | summarize arg_max(TimeGenerated, *) by FindingId
  | join kind=leftouter (
      XbowAssets_CL
      | summarize arg_max(TimeGenerated, *) by AssetId
      | project AssetId, StartUrl
  ) on AssetId
  | project
      TimeGenerated,
      FindingId,
      FindingName,
      Severity,
      State,
      Summary,
      Impact,
      Mitigations,
      Recipe,
      AssetId,
      AssetName,
      OrganizationId,
      CreatedAt,
      StartUrl
queryFrequency: 30m

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b3c5e2f9-6a8d-4127-9b2e-4f6a8c9d0e12')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b3c5e2f9-6a8d-4127-9b2e-4f6a8c9d0e12')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Medium severity finding on asset {{AssetName}} ({{AssetId}}). {{Summary}}",
          "alertDisplayNameFormat": "XBOW Medium: {{FindingName}}"
        },
        "alertRuleTemplateName": "b3c5e2f9-6a8d-4127-9b2e-4f6a8c9d0e12",
        "customDetails": {
          "AssetID": "AssetId",
          "AssetName": "AssetName",
          "CreatedAt": "CreatedAt",
          "FindingID": "FindingId",
          "FindingName": "FindingName",
          "Mitigations": "Mitigations",
          "OrganizationID": "OrganizationId",
          "Severity": "Severity",
          "State": "State"
        },
        "description": "Creates an incident for each Medium severity finding reported by XBOW that is currently\nin an open state. These findings represent moderate security risks that should be\naddressed in a timely manner. Each alert is deduplicated per finding so re-ingestion\nof the same finding does not produce duplicate incidents.\n",
        "displayName": "XbowMediumFindings",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "StartUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "FindingID"
            ],
            "lookbackDuration": "PT24H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowMediumFindings.yaml",
        "query": "XbowFindings_CL\n| where TimeGenerated > ago(1h)\n| where tolower(Severity) == 'medium'\n| where isempty(State) or tolower(State) == 'open'\n| summarize arg_max(TimeGenerated, *) by FindingId\n| join kind=leftouter (\n    XbowAssets_CL\n    | summarize arg_max(TimeGenerated, *) by AssetId\n    | project AssetId, StartUrl\n) on AssetId\n| project\n    TimeGenerated,\n    FindingId,\n    FindingName,\n    Severity,\n    State,\n    Summary,\n    Impact,\n    Mitigations,\n    Recipe,\n    AssetId,\n    AssetName,\n    OrganizationId,\n    CreatedAt,\n    StartUrl\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Discovery",
          "Reconnaissance"
        ],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}