Preview - TI map Domain entity to Cloud App Events | Microsoft Sentinel Analytic Rules

Back


Id	b97e118c-b7fa-42a6-84de-2e13443fbb8f
Rulename	Preview - TI map Domain entity to Cloud App Events
Description	Identifies compromises and attacks and detect malicious activities in one’s domain entity from TI.
Severity	Medium
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	MicrosoftDefenderThreatIntelligence MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat%20Intelligence/Analytic%20Rules/DomainEntity_CloudAppEvents.yaml
Version	1.0.3
Arm template	b97e118c-b7fa-42a6-84de-2e13443fbb8f.json

KQL

let dt_lookBack = 1h;
let ioc_lookBack = 14d; 
let list_tlds =
  ThreatIntelligenceIndicator
    | where TimeGenerated >= ago(ioc_lookBack)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
    | where Active == true and ExpirationDateTime > now()
    | where isnotempty(DomainName)
    | extend DomainName = tolower(DomainName)
    | extend parts = split(DomainName, '.')
    | extend tld = parts[(array_length(parts) - 1)]
    | summarize count() by tostring(tld)
    | summarize make_set(tld);
let Domain_Indicators =
  ThreatIntelligenceIndicator
    | where TimeGenerated >= ago(ioc_lookBack)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
    | where Active == true and ExpirationDateTime > now()
    | extend TI_DomainEntity = DomainName
    | where isnotempty(TI_DomainEntity);
  Domain_Indicators
    | join kind=innerunique (
  CloudAppEvents
    | extend IngestionTime = ingestion_time()
    | where IngestionTime > ago(dt_lookBack)
    | extend PAUrl = columnifexists("RequestURL", "None")
    | extend Domain = trim('"', tostring(parseurl(PAUrl).Host))
    | extend Domain = tolower(Domain)
    | extend parts = split(Domain, '.')
    | extend tld = parts[(array_length(parts) - 1)]
    | extend CloudAppEvents_TimeGenerated = TimeGenerated) on $left.TI_DomainEntity == $right.Domain
    | where CloudAppEvents_TimeGenerated < ExpirationDateTime
    | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId
    | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, DomainName = max_CloudAppEvents_TimeGenerated_DomainName, ProviderName = max_CloudAppEvents_TimeGenerated_IndicatorProvider, AlertSeverity = max_CloudAppEvents_TimeGenerated_ThreatSeverity, IPAddress = max_CloudAppEvents_TimeGenerated_IPAddress
    | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, ProviderName, AlertSeverity, IPAddress

YAML

queryPeriod: 14d
description: |
  'Identifies compromises and attacks and detect malicious activities in one's domain entity from TI.'
entityMappings:
- fieldMappings:
  - identifier: DomainName
    columnName: DomainName
  entityType: DNS
- fieldMappings:
  - identifier: Address
    columnName: IPAddress
  entityType: IP
kind: Scheduled
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat%20Intelligence/Analytic%20Rules/DomainEntity_CloudAppEvents.yaml
severity: Medium
id: b97e118c-b7fa-42a6-84de-2e13443fbb8f
queryFrequency: 1h
tactics:
- CommandAndControl
name: Preview - TI map Domain entity to Cloud App Events
version: 1.0.3
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - CloudAppEvents
  connectorId: MicrosoftThreatProtection
- dataTypes:
  - ThreatIntelligenceIndicator
  connectorId: MicrosoftDefenderThreatIntelligence
relevantTechniques:
- T1071
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d; 
  let list_tlds =
    ThreatIntelligenceIndicator
      | where TimeGenerated >= ago(ioc_lookBack)
      | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
      | where Active == true and ExpirationDateTime > now()
      | where isnotempty(DomainName)
      | extend DomainName = tolower(DomainName)
      | extend parts = split(DomainName, '.')
      | extend tld = parts[(array_length(parts) - 1)]
      | summarize count() by tostring(tld)
      | summarize make_set(tld);
  let Domain_Indicators =
    ThreatIntelligenceIndicator
      | where TimeGenerated >= ago(ioc_lookBack)
      | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
      | where Active == true and ExpirationDateTime > now()
      | extend TI_DomainEntity = DomainName
      | where isnotempty(TI_DomainEntity);
    Domain_Indicators
      | join kind=innerunique (
    CloudAppEvents
      | extend IngestionTime = ingestion_time()
      | where IngestionTime > ago(dt_lookBack)
      | extend PAUrl = columnifexists("RequestURL", "None")
      | extend Domain = trim('"', tostring(parseurl(PAUrl).Host))
      | extend Domain = tolower(Domain)
      | extend parts = split(Domain, '.')
      | extend tld = parts[(array_length(parts) - 1)]
      | extend CloudAppEvents_TimeGenerated = TimeGenerated) on $left.TI_DomainEntity == $right.Domain
      | where CloudAppEvents_TimeGenerated < ExpirationDateTime
      | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId
      | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, DomainName = max_CloudAppEvents_TimeGenerated_DomainName, ProviderName = max_CloudAppEvents_TimeGenerated_IndicatorProvider, AlertSeverity = max_CloudAppEvents_TimeGenerated_ThreatSeverity, IPAddress = max_CloudAppEvents_TimeGenerated_IPAddress
      | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, ProviderName, AlertSeverity, IPAddress

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/b97e118c-b7fa-42a6-84de-2e13443fbb8f')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/b97e118c-b7fa-42a6-84de-2e13443fbb8f')]",
      "properties": {
        "alertRuleTemplateName": "b97e118c-b7fa-42a6-84de-2e13443fbb8f",
        "customDetails": null,
        "description": "'Identifies compromises and attacks and detect malicious activities in one's domain entity from TI.'\n",
        "displayName": "Preview - TI map Domain entity to Cloud App Events",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "DomainName",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPAddress",
                "identifier": "Address"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Threat%20Intelligence/Analytic%20Rules/DomainEntity_CloudAppEvents.yaml",
        "query": "let dt_lookBack = 1h;\nlet ioc_lookBack = 14d; \nlet list_tlds =\n  ThreatIntelligenceIndicator\n    | where TimeGenerated >= ago(ioc_lookBack)\n    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n    | where Active == true and ExpirationDateTime > now()\n    | where isnotempty(DomainName)\n    | extend DomainName = tolower(DomainName)\n    | extend parts = split(DomainName, '.')\n    | extend tld = parts[(array_length(parts) - 1)]\n    | summarize count() by tostring(tld)\n    | summarize make_set(tld);\nlet Domain_Indicators =\n  ThreatIntelligenceIndicator\n    | where TimeGenerated >= ago(ioc_lookBack)\n    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n    | where Active == true and ExpirationDateTime > now()\n    | extend TI_DomainEntity = DomainName\n    | where isnotempty(TI_DomainEntity);\n  Domain_Indicators\n    | join kind=innerunique (\n  CloudAppEvents\n    | extend IngestionTime = ingestion_time()\n    | where IngestionTime > ago(dt_lookBack)\n    | extend PAUrl = columnifexists(\"RequestURL\", \"None\")\n    | extend Domain = trim('\"', tostring(parseurl(PAUrl).Host))\n    | extend Domain = tolower(Domain)\n    | extend parts = split(Domain, '.')\n    | extend tld = parts[(array_length(parts) - 1)]\n    | extend CloudAppEvents_TimeGenerated = TimeGenerated) on $left.TI_DomainEntity == $right.Domain\n    | where CloudAppEvents_TimeGenerated < ExpirationDateTime\n    | summarize CloudAppEvents_TimeGenerated = argmax(CloudAppEvents_TimeGenerated, *) by IndicatorId\n    | extend Description = max_CloudAppEvents_TimeGenerated_Description, ActivityGroupNames = max_CloudAppEvents_TimeGenerated_ActivityGroupNames, ThreatType = max_CloudAppEvents_TimeGenerated_ThreatType, ExpirationDateTime = max_CloudAppEvents_TimeGenerated_ExpirationDateTime, ConfidenceScore = max_CloudAppEvents_TimeGenerated_ConfidenceScore, DomainName = max_CloudAppEvents_TimeGenerated_DomainName, ProviderName = max_CloudAppEvents_TimeGenerated_IndicatorProvider, AlertSeverity = max_CloudAppEvents_TimeGenerated_ThreatSeverity, IPAddress = max_CloudAppEvents_TimeGenerated_IPAddress\n    | project CloudAppEvents_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, DomainName, ProviderName, AlertSeverity, IPAddress\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P14D",
        "severity": "Medium",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl"
        ],
        "techniques": [
          "T1071"
        ],
        "templateVersion": "1.0.3",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}