Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Theom Low Risks

Back
Idcf7fb616-ac80-40ce-ad18-aa18912811f8
RulenameTheom Low Risks
Description“Creates Microsoft Sentinel incidents for low risk Theom alerts”
SeverityHigh
TacticsCollection
CommandAndControl
CredentialAccess
DefenseEvasion
Discovery
Exfiltration
Impact
Reconnaissance
TechniquesT1592
T1589
T1070
T1552
T1619
T1119
T1560
T1530
T1213
T1001
T1041
T1537
T1485
T1486
T1565
Required data connectorsTheom
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TheomRisksLow.yaml
Version1.0.2
Arm templatecf7fb616-ac80-40ce-ad18-aa18912811f8.json
Deploy To Azure
TheomAlerts_CL
 | where priority_s == "P4"
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TheomRisksLow.yaml
query: |
  TheomAlerts_CL
   | where priority_s == "P4"  
description: |
    "Creates Microsoft Sentinel incidents for low risk Theom alerts"
severity: High
requiredDataConnectors:
- dataTypes:
  - TheomAlerts_CL
  connectorId: Theom
eventGroupingSettings:
  aggregationKind: AlertPerResult
name: Theom Low Risks
triggerThreshold: 0
version: 1.0.2
tactics:
- Collection
- CommandAndControl
- CredentialAccess
- DefenseEvasion
- Discovery
- Exfiltration
- Impact
- Reconnaissance
alertDetailsOverride:
  alertDescriptionFormat: |2

    Summary: {{summary_s}}  
    Additional info: {{details_s}}
    Please investigate further on Theom UI at {{deepLink_s}}
  alertDisplayNameFormat: 'Theom Alert ID: {{id_s}} '
relevantTechniques:
- T1592
- T1589
- T1070
- T1552
- T1619
- T1119
- T1560
- T1530
- T1213
- T1001
- T1041
- T1537
- T1485
- T1486
- T1565
triggerOperator: gt
entityMappings:
- entityType: CloudApplication
  fieldMappings:
  - columnName: customProps_AssetName_s
    identifier: Name
- entityType: URL
  fieldMappings:
  - columnName: deepLink_s
    identifier: Url
id: cf7fb616-ac80-40ce-ad18-aa18912811f8
status: Available
kind: Scheduled
queryFrequency: 5m
queryPeriod: 5m
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/cf7fb616-ac80-40ce-ad18-aa18912811f8')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/cf7fb616-ac80-40ce-ad18-aa18912811f8')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "\nSummary: {{summary_s}}  \nAdditional info: {{details_s}}\nPlease investigate further on Theom UI at {{deepLink_s}}\n",
          "alertDisplayNameFormat": "Theom Alert ID: {{id_s}} "
        },
        "alertRuleTemplateName": "cf7fb616-ac80-40ce-ad18-aa18912811f8",
        "customDetails": null,
        "description": "\"Creates Microsoft Sentinel incidents for low risk Theom alerts\"\n",
        "displayName": "Theom Low Risks",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "customProps_AssetName_s",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "deepLink_s",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TheomRisksLow.yaml",
        "query": "TheomAlerts_CL\n | where priority_s == \"P4\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CommandAndControl",
          "CredentialAccess",
          "DefenseEvasion",
          "Discovery",
          "Exfiltration",
          "Impact",
          "Reconnaissance"
        ],
        "techniques": [
          "T1001",
          "T1041",
          "T1070",
          "T1119",
          "T1213",
          "T1485",
          "T1486",
          "T1530",
          "T1537",
          "T1552",
          "T1560",
          "T1565",
          "T1589",
          "T1592",
          "T1619"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}