Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

SpyCloud Enterprise Breach Detection

Back
Idcb410ad5-6e9d-4278-b963-1e3af205d680
RulenameSpyCloud Enterprise Breach Detection
DescriptionThis alert creates an incident when an malware record is detected in the SpyCloud watchlist data
SeverityHigh
TacticsCredentialAccess
TechniquesT1555
KindScheduled
Query frequency12h
Query period12h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SpyCloud Enterprise Protection/Analytic Rules/SpyCloudEnterpriseProtectionBreachRule.yaml
Version1.0.1
Arm templatecb410ad5-6e9d-4278-b963-1e3af205d680.json
Deploy To Azure
SpyCloudBreachDataWatchlist_CL
| where Severity_s == '20'
| project TimeGenerated, Document_Id_g, Source_Id_s, SpyCloud_Publish_Date_t, Email_s, Domain_s, Password_s, Password_Plaintext_s, Username_s, IP_Address_s
severity: High
customDetails:
  PublishDate: SpyCloud_Publish_Date_t
  Document_Id: Document_Id_g
  Source_Id: Source_Id_s
  Password: Password_s
  Domain: Domain_s
  Password_Plaintext: Password_Plaintext_s
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SpyCloud Enterprise Protection/Analytic Rules/SpyCloudEnterpriseProtectionBreachRule.yaml
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: 12h
    enabled: true
    reopenClosedIncident: false
requiredDataConnectors: []
alertDetailsOverride: 
id: cb410ad5-6e9d-4278-b963-1e3af205d680
suppressionDuration: 5h
tactics:
- CredentialAccess
queryFrequency: 12h
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerOperator: gt
relevantTechniques:
- T1555
description: |
    'This alert creates an incident when an malware record is detected in the SpyCloud watchlist data'
triggerThreshold: 0
kind: Scheduled
name: SpyCloud Enterprise Breach Detection
query: |
  SpyCloudBreachDataWatchlist_CL
  | where Severity_s == '20'
  | project TimeGenerated, Document_Id_g, Source_Id_s, SpyCloud_Publish_Date_t, Email_s, Domain_s, Password_s, Password_Plaintext_s, Username_s, IP_Address_s  
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Email_s
    identifier: FullName
- entityType: Account
  fieldMappings:
  - columnName: Username_s
    identifier: Name
- entityType: IP
  fieldMappings:
  - columnName: IP_Address_s
    identifier: Address
status: Available
sentinelEntitiesMappings: 
version: 1.0.1
queryPeriod: 12h
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cb410ad5-6e9d-4278-b963-1e3af205d680')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cb410ad5-6e9d-4278-b963-1e3af205d680')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "SpyCloud Enterprise Breach Detection",
        "description": "'This alert creates an incident when an malware record is detected in the SpyCloud watchlist data'\n",
        "severity": "High",
        "enabled": true,
        "query": "SpyCloudBreachDataWatchlist_CL\n| where Severity_s == '20'\n| project TimeGenerated, Document_Id_g, Source_Id_s, SpyCloud_Publish_Date_t, Email_s, Domain_s, Password_s, Password_Plaintext_s, Username_s, IP_Address_s\n",
        "queryFrequency": "PT12H",
        "queryPeriod": "PT12H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1555"
        ],
        "alertRuleTemplateName": "cb410ad5-6e9d-4278-b963-1e3af205d680",
        "incidentConfiguration": {
          "groupingConfiguration": {
            "enabled": true,
            "lookbackDuration": "PT12H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          },
          "createIncident": true
        },
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "alertDetailsOverride": null,
        "customDetails": {
          "PublishDate": "SpyCloud_Publish_Date_t",
          "Document_Id": "Document_Id_g",
          "Source_Id": "Source_Id_s",
          "Password": "Password_s",
          "Domain": "Domain_s",
          "Password_Plaintext": "Password_Plaintext_s"
        },
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "Email_s"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "Username_s"
              }
            ],
            "entityType": "Account"
          },
          {
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "IP_Address_s"
              }
            ],
            "entityType": "IP"
          }
        ],
        "sentinelEntitiesMappings": null,
        "status": "Available",
        "templateVersion": "1.0.1",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SpyCloud Enterprise Protection/Analytic Rules/SpyCloudEnterpriseProtectionBreachRule.yaml"
      }
    }
  ]
}