ExtraHopDetections
| where IsRecommended == true
queryFrequency: 15m
version: 1.0.2
queryPeriod: 15m
incidentConfiguration:
createIncident: false
relevantTechniques:
- T1546
name: Generate alerts based on ExtraHop detections recommended for triage
alertDetailsOverride:
alertTacticsColumnName: TacticNames
alertDynamicProperties:
- alertProperty: AlertLink
value: Url
- alertProperty: Techniques
value: TechniqueIds
- alertProperty: ProductName
value: EventVendor
alertSeverityColumnName: Severity
alertDescriptionFormat: Alert from {{EventVendor}} for Detection {{Title}} for Id {{Id}}
alertDisplayNameFormat: Alert from {{EventVendor}} for Detection {{Title}}
kind: Scheduled
severity: Medium
tactics:
- Persistence
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ExtraHop/Analytic Rules/ExtraHopSentinelAlerts.yaml
requiredDataConnectors:
- dataTypes:
- ExtraHopDetections
connectorId: ExtraHop
triggerOperator: GreaterThan
id: cd65aebc-7e85-4cbb-9f91-ff0376c5d37d
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: SourceHostname
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: DestinationHostname
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIpAddress
- entityType: IP
fieldMappings:
- identifier: Address
columnName: DestinationIpAddress
- entityType: Account
fieldMappings:
- identifier: Name
columnName: SourceUsername
- entityType: Account
fieldMappings:
- identifier: Name
columnName: DestinationUsername
triggerThreshold: 0
query: |
ExtraHopDetections
| where IsRecommended == true
status: Available
description: |
'This analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage.'
