Virtual Machines Alerts for Prancer

Back


Id	c13b025c-ea31-4e4b-8e08-955b8fa91fa0
Rulename	Virtual Machines Alerts for Prancer
Description	High severity virtual machine alerts found by Prancer.
Severity	High
Tactics	Reconnaissance
Techniques	T1595
Required data connectors	PrancerLogData
Kind	Scheduled
Query frequency	5h
Query period	5h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/VM_High_Severity.yaml
Version	1.0.2
Arm template	c13b025c-ea31-4e4b-8e08-955b8fa91fa0.json

KQL

union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Compute/virtualMachines'
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot 
| extend
    id = tostring(snapshot.id),
    structure = tostring(snapshot.structure),
    reference = tostring(snapshot.reference),
    source = tostring(snapshot.source),
    collection = tostring(snapshot.collection),
    type = tostring(snapshot.type),
    region = tostring(snapshot.region),
    resourceTypes = tostring(snapshot.resourceTypes),
    path = tostring(snapshot.path)

YAML

queryFrequency: 5h
queryPeriod: 5h
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Prancer PenSuiteAI Integration/Analytic Rules/VM_High_Severity.yaml
tactics:
- Reconnaissance
version: 1.0.2
severity: High
description: |
    'High severity virtual machine alerts found by Prancer.'
entityMappings:
- fieldMappings:
  - columnName: path
    identifier: ResourceId
  entityType: AzureResource
query: |
  union prancer_CL
  | where deviceProduct_s == 'azure'
  | where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Compute/virtualMachines'
  | where data_data_severity_s == 'High' and data_data_result_s == 'failed'
  | extend snapshot = parse_json(data_data_snapshots_s)
  | mv-expand snapshot 
  | extend
      id = tostring(snapshot.id),
      structure = tostring(snapshot.structure),
      reference = tostring(snapshot.reference),
      source = tostring(snapshot.source),
      collection = tostring(snapshot.collection),
      type = tostring(snapshot.type),
      region = tostring(snapshot.region),
      resourceTypes = tostring(snapshot.resourceTypes),
      path = tostring(snapshot.path)  
triggerThreshold: 0
relevantTechniques:
- T1595
kind: Scheduled
id: c13b025c-ea31-4e4b-8e08-955b8fa91fa0
eventGroupingSettings:
  aggregationKind: SingleAlert
name: Virtual Machines Alerts for Prancer
requiredDataConnectors:
- dataTypes:
  - prancer_CL
  connectorId: PrancerLogData
alertDetailsOverride:
  alertSeverityColumnName: '{{data_data_severity_s}}'
  alertDisplayNameFormat: '{{data_data_message_s}}'
  alertDescriptionFormat: '{{data_data_description_s}}'
  alertDynamicProperties:
  - alertProperty: RemediationSteps
    value: data_data_remediation_description_s
customDetails: 
status: Available

ARM