GTI - Initial Access Broker Alert Detected | Microsoft Sentinel Analytic Rules

Back


Id	c3d4e5f6-a7b8-9012-cdef-123456789013
Rulename	GTI - Initial Access Broker Alert Detected
Description	Triggers an incident when a GTI Relevance System Alert of type initial_access_broker is ingested. Initial Access Broker alerts indicate that a threat actor is advertising or has sold access (credentials, VPN, RDP, admin panels, etc.) to an organisation that matches your profile. These are high-urgency signals that may indicate imminent compromise or an ongoing breach. Each unique Alert ID is grouped into a single incident.
Severity	High
Tactics	InitialAccess CredentialAccess
Techniques	T1078 T1133 T1190 T1552
Required data connectors	GoogleThreatIntelligenceRelevanceSystemAlertsAPI
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_InitialAccessBrokerAlerts.yaml
Version	1.0.0
Arm template	c3d4e5f6-a7b8-9012-cdef-123456789013.json

KQL

GTIRelevanceSystemAlerts
| where DetailType == "initial_access_broker"
| project
    TimeGenerated,
    AlertId,
    AlertName                       = DisplayName,
    AlertState                      = State,
    BrokerSeverity                  = InitialAccessBrokerSeverity,
    DiscoveryDocuments              = InitialAccessBrokerDiscoveryDocumentIds,
    PriorityLevel,
    PriorityReasoning,
    SeverityLevel,
    SeverityConfidence,
    SeverityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    CommonThemes                    = RelevanceEvidenceCommonThemes,
    DistinctThemes                  = RelevanceEvidenceDistinctThemes,
    AuditCreateTime,
    AuditUpdateTime

YAML

requiredDataConnectors:
- dataTypes:
  - RelevanceSystemAlerts_CL
  connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_InitialAccessBrokerAlerts.yaml
version: 1.0.0
status: Available
alertDetailsOverride:
  alertDescriptionFormat: |
    Broker Severity: {{BrokerSeverity}} | Priority: {{PriorityLevel}}

    Summary: {{AiSummary}}
  alertDisplayNameFormat: 'GTI Initial Access Broker: {{AlertName}}'
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: P5D
    matchingMethod: Selected
    reopenClosedIncident: false
    enabled: true
    groupByCustomDetails:
    - AlertId
  createIncident: true
queryFrequency: 5m
query: |
  GTIRelevanceSystemAlerts
  | where DetailType == "initial_access_broker"
  | project
      TimeGenerated,
      AlertId,
      AlertName                       = DisplayName,
      AlertState                      = State,
      BrokerSeverity                  = InitialAccessBrokerSeverity,
      DiscoveryDocuments              = InitialAccessBrokerDiscoveryDocumentIds,
      PriorityLevel,
      PriorityReasoning,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      CommonThemes                    = RelevanceEvidenceCommonThemes,
      DistinctThemes                  = RelevanceEvidenceDistinctThemes,
      AuditCreateTime,
      AuditUpdateTime
tactics:
- InitialAccess
- CredentialAccess
relevantTechniques:
- T1078
- T1133
- T1190
- T1552
id: c3d4e5f6-a7b8-9012-cdef-123456789013
triggerThreshold: 0
triggerOperator: gt
name: GTI - Initial Access Broker Alert Detected
queryPeriod: 5m
severity: High
customDetails:
  RelevanceLevel: RelevanceLevel
  BrokerSeverity: BrokerSeverity
  AlertId: AlertId
  FindingCount: FindingCount
  SeverityLevel: SeverityLevel
  AlertState: AlertState
  PriorityLevel: PriorityLevel
kind: Scheduled
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |
  Triggers an incident when a GTI Relevance System Alert of type initial_access_broker is ingested.
  Initial Access Broker alerts indicate that a threat actor is advertising or has sold access
  (credentials, VPN, RDP, admin panels, etc.) to an organisation that matches your profile.
  These are high-urgency signals that may indicate imminent compromise or an ongoing breach.
  Each unique Alert ID is grouped into a single incident.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c3d4e5f6-a7b8-9012-cdef-123456789013')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c3d4e5f6-a7b8-9012-cdef-123456789013')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Broker Severity: {{BrokerSeverity}} | Priority: {{PriorityLevel}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI Initial Access Broker: {{AlertName}}"
        },
        "alertRuleTemplateName": "c3d4e5f6-a7b8-9012-cdef-123456789013",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "BrokerSeverity": "BrokerSeverity",
          "FindingCount": "FindingCount",
          "PriorityLevel": "PriorityLevel",
          "RelevanceLevel": "RelevanceLevel",
          "SeverityLevel": "SeverityLevel"
        },
        "description": "Triggers an incident when a GTI Relevance System Alert of type initial_access_broker is ingested.\nInitial Access Broker alerts indicate that a threat actor is advertising or has sold access\n(credentials, VPN, RDP, admin panels, etc.) to an organisation that matches your profile.\nThese are high-urgency signals that may indicate imminent compromise or an ongoing breach.\nEach unique Alert ID is grouped into a single incident.\n",
        "displayName": "GTI - Initial Access Broker Alert Detected",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_InitialAccessBrokerAlerts.yaml",
        "query": "GTIRelevanceSystemAlerts\n| where DetailType == \"initial_access_broker\"\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName                       = DisplayName,\n    AlertState                      = State,\n    BrokerSeverity                  = InitialAccessBrokerSeverity,\n    DiscoveryDocuments              = InitialAccessBrokerDiscoveryDocumentIds,\n    PriorityLevel,\n    PriorityReasoning,\n    SeverityLevel,\n    SeverityConfidence,\n    SeverityReasoning,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    FindingCount,\n    AiSummary,\n    CommonThemes                    = RelevanceEvidenceCommonThemes,\n    DistinctThemes                  = RelevanceEvidenceDistinctThemes,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "InitialAccess"
        ],
        "techniques": [
          "T1078",
          "T1133",
          "T1190",
          "T1552"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}