Varonis - Medium severity alerts detected | Microsoft Sentinel Analytic Rules

Back


Id	c4e8b16f-3a92-4d75-8e21-6f9c0b5d2a84
Rulename	Varonis - Medium severity alerts detected
Description	Identifies medium-severity alerts generated by Varonis that indicate suspicious activity requiring review and investigation to assess potential security impact.
Severity	Medium
Tactics	Collection Exfiltration
Techniques	T1530 T1213 T1567
Required data connectors	VaronisSaaSAlertsPush
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VaronisSaaS/Analytic%20Rules/VaronisMediumSeverityAlertsDetected.yaml
Version	1.0.1
Arm template	c4e8b16f-3a92-4d75-8e21-6f9c0b5d2a84.json

KQL

VaronisAlertsV2_CL
| where AlertSeverity_s == "Medium"

YAML

queryFrequency: 5m
entityMappings:
- fieldMappings:
  - columnName: UserNames_s
    identifier: FullName
  - columnName: UserSamAccountNames_s
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: DeviceNames_s
    identifier: HostName
  entityType: Host
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    enabled: false
    reopenClosedIncident: false
triggerThreshold: 0
triggerOperator: gt
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VaronisSaaS/Analytic%20Rules/VaronisMediumSeverityAlertsDetected.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})'
  alertDescriptionFormat: 'Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.'
query: |
  VaronisAlertsV2_CL
  | where AlertSeverity_s == "Medium"
tactics:
- Collection
- Exfiltration
queryPeriod: 5m
customDetails:
  AlertCategory: AlertCategory_s
  VaronisAlertGuid: AlertId_g
  MitreTactic: MitreTacticName_s
  Status: Status_s
  EventsCount: EventsCount_d
relevantTechniques:
- T1530
- T1213
- T1567
requiredDataConnectors:
- connectorId: VaronisSaaSAlertsPush
  dataTypes:
  - VaronisAlertsV2_CL
id: c4e8b16f-3a92-4d75-8e21-6f9c0b5d2a84
kind: Scheduled
version: 1.0.1
description: |
  'Identifies medium-severity alerts generated by Varonis that indicate suspicious activity requiring review and investigation to assess potential security impact.'
status: Available
name: Varonis - Medium severity alerts detected

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/c4e8b16f-3a92-4d75-8e21-6f9c0b5d2a84')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/c4e8b16f-3a92-4d75-8e21-6f9c0b5d2a84')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.",
          "alertDisplayNameFormat": "Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})"
        },
        "alertRuleTemplateName": "c4e8b16f-3a92-4d75-8e21-6f9c0b5d2a84",
        "customDetails": {
          "AlertCategory": "AlertCategory_s",
          "EventsCount": "EventsCount_d",
          "MitreTactic": "MitreTacticName_s",
          "Status": "Status_s",
          "VaronisAlertGuid": "AlertId_g"
        },
        "description": "'Identifies medium-severity alerts generated by Varonis that indicate suspicious activity requiring review and investigation to assess potential security impact.'\n",
        "displayName": "Varonis - Medium severity alerts detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "UserNames_s",
                "identifier": "FullName"
              },
              {
                "columnName": "UserSamAccountNames_s",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceNames_s",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/VaronisSaaS/Analytic%20Rules/VaronisMediumSeverityAlertsDetected.yaml",
        "query": "VaronisAlertsV2_CL\n| where AlertSeverity_s == \"Medium\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "Exfiltration"
        ],
        "techniques": [
          "T1213",
          "T1530",
          "T1567"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}