let timeframe = ago(1d);
AppServiceAntivirusScanAuditLogs
| where ScanStatus == "Failed"
| extend HostCustomEntity = _ResourceId, timestamp = TimeGenerated
severity: Informational
queryFrequency: 1d
triggerOperator: gt
kind: Scheduled
query: |
let timeframe = ago(1d);
AppServiceAntivirusScanAuditLogs
| where ScanStatus == "Failed"
| extend HostCustomEntity = _ResourceId, timestamp = TimeGenerated
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureAppServices/AVScan_Failure.yaml
queryPeriod: 1d
version: 1.0.2
metadata:
support:
tier: Community
source:
kind: Community
categories:
domains:
- Security - Others
- Platform
author:
name: SecurityJedi
name: AppServices AV Scan Failure
requiredDataConnectors: []
entityMappings:
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: HostCustomEntity
id: c2da1106-bfe4-4a63-bf14-5ab73130ccd5
description: |
'Identifies if an AV scan fails in Azure App Services.'
triggerThreshold: 1
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c2da1106-bfe4-4a63-bf14-5ab73130ccd5')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c2da1106-bfe4-4a63-bf14-5ab73130ccd5')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01-preview",
"properties": {
"displayName": "AppServices AV Scan Failure",
"description": "'Identifies if an AV scan fails in Azure App Services.'\n",
"severity": "Informational",
"enabled": true,
"query": "let timeframe = ago(1d);\nAppServiceAntivirusScanAuditLogs\n| where ScanStatus == \"Failed\"\n| extend HostCustomEntity = _ResourceId, timestamp = TimeGenerated\n",
"queryFrequency": "P1D",
"queryPeriod": "P1D",
"triggerOperator": "GreaterThan",
"triggerThreshold": 1,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"alertRuleTemplateName": "c2da1106-bfe4-4a63-bf14-5ab73130ccd5",
"customDetails": null,
"entityMappings": [
{
"fieldMappings": [
{
"columnName": "HostCustomEntity",
"identifier": "FullName"
}
],
"entityType": "Host"
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AzureAppServices/AVScan_Failure.yaml",
"templateVersion": "1.0.2"
}
}
]
}