Cyble Vision Alerts OTICS Threat Activity Detected | Microsoft Sentinel Analytic Rules

Back


Id	c1ebc79d-7f46-429e-bf2c-8bb0b75ba6b2
Rulename	Cyble Vision Alerts OT/ICS Threat Activity Detected
Description	This alert indicates detection of OT/ICS-related network activity involving industrial control protocols (e.g., IEC104). May indicate probing, reconnaissance, or attempted access against critical infrastructure assets.
Severity	Low
Tactics	Discovery Collection
Techniques	T0842 T0830
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ot_ics_rule.yaml
Version	1.0.0
Arm template	c1ebc79d-7f46-429e-bf2c-8bb0b75ba6b2.json

KQL

Alerts_ot_ics  
| where Service == "ot_ics" 
| extend MappedSeverity = Severity

YAML

triggerThreshold: 0
incidentConfiguration:
  alertDisplayNameFormat: OT/ICS Activity Detected from {{OT_SourceIP}}
  description: |
    Cyble detected industrial control system related traffic involving protocol {{OT_DataType}} from IP {{OT_SourceIP}}. Destination port {{OT_DestPort}}. Country. {{OT_Country}}. This may indicate reconnaissance or hostile probing of OT/ICS infrastructure.
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
    lookbackDuration: PT5H
  alertDetailsOverride: 
kind: Scheduled
description: |
  'This alert indicates detection of OT/ICS-related network activity involving industrial control protocols (e.g., IEC104). May indicate probing, reconnaissance, or attempted access against critical infrastructure assets.'
queryfrequency: 30m
triggerOperator: GreaterThan
relevantTechniques:
- T0842
- T0830
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: OT_SourceIP
  entityType: IP
id: c1ebc79d-7f46-429e-bf2c-8bb0b75ba6b2
enabled: true
query: |
  Alerts_ot_ics  
  | where Service == "ot_ics" 
  | extend MappedSeverity = Severity
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ot_ics_rule.yaml
requiredDataConnectors:
- dataTypes:
  - CybleVisionAlerts_CL
  connectorId: CybleVisionAlerts
customDetails:
  OT_Country: OT_Country
  OT_IP_Reputation: OT_IP_Reputation
  MappedSeverity: Severity
  OT_SourceIP: OT_SourceIP
  Service: Service
  OT_DataType: OT_DataType
  Status: Status
  OT_ASN: OT_ASN
  AlertID: AlertID
  OT_DestPort: OT_DestPort
tactics:
- Discovery
- Collection
queryPeriod: 30m
severity: Low
status: Available
name: Cyble Vision Alerts OT/ICS Threat Activity Detected

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c1ebc79d-7f46-429e-bf2c-8bb0b75ba6b2')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c1ebc79d-7f46-429e-bf2c-8bb0b75ba6b2')]",
      "properties": {
        "alertRuleTemplateName": "c1ebc79d-7f46-429e-bf2c-8bb0b75ba6b2",
        "customDetails": {
          "AlertID": "AlertID",
          "MappedSeverity": "Severity",
          "OT_ASN": "OT_ASN",
          "OT_Country": "OT_Country",
          "OT_DataType": "OT_DataType",
          "OT_DestPort": "OT_DestPort",
          "OT_IP_Reputation": "OT_IP_Reputation",
          "OT_SourceIP": "OT_SourceIP",
          "Service": "Service",
          "Status": "Status"
        },
        "description": "'This alert indicates detection of OT/ICS-related network activity involving industrial control protocols (e.g., IEC104). May indicate probing, reconnaissance, or attempted access against critical infrastructure assets.'\n",
        "displayName": "Cyble Vision Alerts OT/ICS Threat Activity Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "OT_SourceIP",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "alertDetailsOverride": null,
          "alertDisplayNameFormat": "OT/ICS Activity Detected from {{OT_SourceIP}}",
          "createIncident": true,
          "description": "Cyble detected industrial control system related traffic involving protocol {{OT_DataType}} from IP {{OT_SourceIP}}. Destination port {{OT_DestPort}}. Country. {{OT_Country}}. This may indicate reconnaissance or hostile probing of OT/ICS infrastructure.\n",
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ot_ics_rule.yaml",
        "query": "Alerts_ot_ics  \n| where Service == \"ot_ics\" \n| extend MappedSeverity = Severity\n",
        "queryfrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Discovery"
        ],
        "techniques": null,
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}