ExtraHopDetections
| where IsRecommended == true
status: Available
relevantTechniques:
- T1546
triggerThreshold: 0
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml
queryPeriod: 15m
query: |
ExtraHopDetections
| where IsRecommended == true
id: cd65aebc-7e85-4cbb-9f91-ff0376c5d37d
entityMappings:
- fieldMappings:
- columnName: SourceHostname
identifier: HostName
entityType: Host
- fieldMappings:
- columnName: DestinationHostname
identifier: HostName
entityType: Host
- fieldMappings:
- columnName: SourceIpAddress
identifier: Address
entityType: IP
- fieldMappings:
- columnName: DestinationIpAddress
identifier: Address
entityType: IP
- fieldMappings:
- columnName: SourceUsername
identifier: Name
entityType: Account
- fieldMappings:
- columnName: DestinationUsername
identifier: Name
entityType: Account
name: Generate alerts based on ExtraHop detections recommended for triage
kind: Scheduled
description: |
'This analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage.'
tactics:
- Persistence
version: 1.0.2
alertDetailsOverride:
alertDisplayNameFormat: Alert from {{EventVendor}} for Detection {{Title}}
alertDescriptionFormat: Alert from {{EventVendor}} for Detection {{Title}} for Id {{Id}}
alertTacticsColumnName: TacticNames
alertDynamicProperties:
- value: Url
alertProperty: AlertLink
- value: TechniqueIds
alertProperty: Techniques
- value: EventVendor
alertProperty: ProductName
alertSeverityColumnName: Severity
eventGroupingSettings:
aggregationKind: AlertPerResult
incidentConfiguration:
createIncident: false
triggerOperator: GreaterThan
queryFrequency: 15m
requiredDataConnectors:
- connectorId: ExtraHop
dataTypes:
- ExtraHopDetections
