Cynerio - Suspicious Connection to External Address | Microsoft Sentinel Analytic Rules

Back


Id	c0756978-baa6-4239-9174-bac1b1ca1a6a
Rulename	Cynerio - Suspicious Connection to External Address
Description	Suspicious Connection to External Address
Severity	High
Tactics	LateralMovement
Techniques	T0866
Required data connectors	CynerioSecurityEvents
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic%20Rules/SuspiciousConnections.yaml
Version	1.0.0
Arm template	c0756978-baa6-4239-9174-bac1b1ca1a6a.json

KQL

CynerioEvent_CL
| where TimeGenerated > ago(24h)
| where module_s == 'IDS'
| where title_s == 'Suspicious Connection'

YAML

severity: High
relevantTechniques:
- T0866
version: 1.0.0
triggerThreshold: 0
tactics:
- LateralMovement
query: |
  CynerioEvent_CL
  | where TimeGenerated > ago(24h)
  | where module_s == 'IDS'
  | where title_s == 'Suspicious Connection'
customDetails:
  Hostname: host_s
  DstIP: dst_ip_s
name: Cynerio - Suspicious Connection to External Address
kind: Scheduled
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: asset_ip_s
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
  - CynerioEvent_CL
  connectorId: CynerioSecurityEvents
queryFrequency: 5h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic%20Rules/SuspiciousConnections.yaml
description: Suspicious Connection to External Address
queryPeriod: 5h
id: c0756978-baa6-4239-9174-bac1b1ca1a6a
eventGroupingSettings:
  aggregationKind: SingleAlert

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c0756978-baa6-4239-9174-bac1b1ca1a6a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c0756978-baa6-4239-9174-bac1b1ca1a6a')]",
      "properties": {
        "alertRuleTemplateName": "c0756978-baa6-4239-9174-bac1b1ca1a6a",
        "customDetails": {
          "DstIP": "dst_ip_s",
          "Hostname": "host_s"
        },
        "description": "Suspicious Connection to External Address",
        "displayName": "Cynerio - Suspicious Connection to External Address",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "asset_ip_s",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cynerio/Analytic%20Rules/SuspiciousConnections.yaml",
        "query": "CynerioEvent_CL\n| where TimeGenerated > ago(24h)\n| where module_s == 'IDS'\n| where title_s == 'Suspicious Connection'\n",
        "queryFrequency": "PT5H",
        "queryPeriod": "PT5H",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "LateralMovement"
        ],
        "techniques": null,
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}