Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Generate alerts based on ExtraHop detections recommended for triage

Back
Idcd65aebc-7e85-4cbb-9f91-ff0376c5d37d
RulenameGenerate alerts based on ExtraHop detections recommended for triage
DescriptionThis analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage.
SeverityMedium
TacticsPersistence
TechniquesT1546
Required data connectorsExtraHop
KindScheduled
Query frequency15m
Query period15m
Trigger threshold0
Trigger operatorGreaterThan
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml
Version1.0.1
Arm templatecd65aebc-7e85-4cbb-9f91-ff0376c5d37d.json
Deploy To Azure
ExtraHopDetections
| where IsRecommended == true
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml
query: |
  ExtraHopDetections
  | where IsRecommended == true  
description: |
    'This analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage.'
severity: Medium
requiredDataConnectors:
- dataTypes:
  - ExtraHopDetections
  connectorId: ExtraHop
incidentConfiguration:
  createIncident: false
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: Generate alerts based on ExtraHop detections recommended for triage
triggerThreshold: 0
version: 1.0.1
tactics:
- Persistence
alertDetailsOverride:
  alertSeverityColumnName: Severity
  alertDescriptionFormat: Alert from {{EventVendor}} for Detection {{Title}} for Id {{Id}}
  alertDynamicProperties:
  - columnName: Url
    alertProperty: AlertLink
  - columnName: TechniqueIds
    alertProperty: Techniques
  - columnName: EventVendor
    alertProperty: ProductName
  alertDisplayNameFormat: Alert from {{EventVendor}} for Detection {{Title}}
  alertTacticsColumnName: TacticNames
relevantTechniques:
- T1546
triggerOperator: GreaterThan
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: SourceHostname
    identifier: HostName
- entityType: Host
  fieldMappings:
  - columnName: DestinationHostname
    identifier: HostName
- entityType: IP
  fieldMappings:
  - columnName: SourceIpAddress
    identifier: Address
- entityType: IP
  fieldMappings:
  - columnName: DestinationIpAddress
    identifier: Address
- entityType: Account
  fieldMappings:
  - columnName: SourceUsername
    identifier: Name
- entityType: Account
  fieldMappings:
  - columnName: DestinationUsername
    identifier: Name
id: cd65aebc-7e85-4cbb-9f91-ff0376c5d37d
status: Available
kind: Scheduled
queryFrequency: 15m
queryPeriod: 15m
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cd65aebc-7e85-4cbb-9f91-ff0376c5d37d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cd65aebc-7e85-4cbb-9f91-ff0376c5d37d')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Alert from {{EventVendor}} for Detection {{Title}} for Id {{Id}}",
          "alertDisplayNameFormat": "Alert from {{EventVendor}} for Detection {{Title}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "columnName": "Url"
            },
            {
              "alertProperty": "Techniques",
              "columnName": "TechniqueIds"
            },
            {
              "alertProperty": "ProductName",
              "columnName": "EventVendor"
            }
          ],
          "alertSeverityColumnName": "Severity",
          "alertTacticsColumnName": "TacticNames"
        },
        "alertRuleTemplateName": "cd65aebc-7e85-4cbb-9f91-ff0376c5d37d",
        "customDetails": null,
        "description": "'This analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage.'\n",
        "displayName": "Generate alerts based on ExtraHop detections recommended for triage",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DestinationHostname",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIpAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "DestinationIpAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "SourceUsername",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "DestinationUsername",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": false
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml",
        "query": "ExtraHopDetections\n| where IsRecommended == true\n",
        "queryFrequency": "PT15M",
        "queryPeriod": "PT15M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": [
          "T1546"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}