XbowLowFindings | Microsoft Sentinel Analytic Rules

Back


Id	d2e4f1a8-7c9b-4356-8e0d-5a2b7c8e9f01
Rulename	XbowLowFindings
Description	Creates an incident for each Low severity finding reported by XBOW that is currently in an open state. These findings represent minor security issues or best-practice violations that should be addressed as part of regular security maintenance. Each alert is deduplicated per finding so re-ingestion of the same finding does not produce duplicate incidents.
Severity	Low
Tactics	Discovery
Required data connectors	XbowSecurityConnector
Kind	Scheduled
Query frequency	1h
Query period	2h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowLowFindings.yaml
Version	1.0.1
Arm template	d2e4f1a8-7c9b-4356-8e0d-5a2b7c8e9f01.json

KQL

XbowFindings_CL
| where TimeGenerated > ago(2h)
| where tolower(Severity) == 'low'
| where isempty(State) or tolower(State) == 'open'
| summarize arg_max(TimeGenerated, *) by FindingId
| join kind=leftouter (
    XbowAssets_CL
    | summarize arg_max(TimeGenerated, *) by AssetId
    | project AssetId, StartUrl
) on AssetId
| project
    TimeGenerated,
    FindingId,
    FindingName,
    Severity,
    State,
    Summary,
    Impact,
    Mitigations,
    Recipe,
    AssetId,
    AssetName,
    OrganizationId,
    CreatedAt,
    StartUrl

YAML

triggerThreshold: 0
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    groupByCustomDetails:
    - FindingID
    matchingMethod: Selected
    enabled: true
    lookbackDuration: 24h
kind: Scheduled
description: |
  Creates an incident for each Low severity finding reported by XBOW that is currently
  in an open state. These findings represent minor security issues or best-practice
  violations that should be addressed as part of regular security maintenance. Each
  alert is deduplicated per finding so re-ingestion of the same finding does not
  produce duplicate incidents.
queryFrequency: 1h
triggerOperator: gt
relevantTechniques: []
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: StartUrl
  entityType: URL
id: d2e4f1a8-7c9b-4356-8e0d-5a2b7c8e9f01
query: |
  XbowFindings_CL
  | where TimeGenerated > ago(2h)
  | where tolower(Severity) == 'low'
  | where isempty(State) or tolower(State) == 'open'
  | summarize arg_max(TimeGenerated, *) by FindingId
  | join kind=leftouter (
      XbowAssets_CL
      | summarize arg_max(TimeGenerated, *) by AssetId
      | project AssetId, StartUrl
  ) on AssetId
  | project
      TimeGenerated,
      FindingId,
      FindingName,
      Severity,
      State,
      Summary,
      Impact,
      Mitigations,
      Recipe,
      AssetId,
      AssetName,
      OrganizationId,
      CreatedAt,
      StartUrl
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'XBOW Low: {{FindingName}}'
  alertDescriptionFormat: Low severity finding on asset {{AssetName}} ({{AssetId}}). {{Summary}}
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowLowFindings.yaml
version: 1.0.1
requiredDataConnectors:
- dataTypes:
  - XbowFindings_CL
  - XbowAssets_CL
  connectorId: XbowSecurityConnector
customDetails:
  FindingName: FindingName
  FindingID: FindingId
  State: State
  OrganizationID: OrganizationId
  Severity: Severity
  CreatedAt: CreatedAt
  AssetName: AssetName
  AssetID: AssetId
  Mitigations: Mitigations
tactics:
- Discovery
queryPeriod: 2h
severity: Low
status: Available
name: XbowLowFindings

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/d2e4f1a8-7c9b-4356-8e0d-5a2b7c8e9f01')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/d2e4f1a8-7c9b-4356-8e0d-5a2b7c8e9f01')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Low severity finding on asset {{AssetName}} ({{AssetId}}). {{Summary}}",
          "alertDisplayNameFormat": "XBOW Low: {{FindingName}}"
        },
        "alertRuleTemplateName": "d2e4f1a8-7c9b-4356-8e0d-5a2b7c8e9f01",
        "customDetails": {
          "AssetID": "AssetId",
          "AssetName": "AssetName",
          "CreatedAt": "CreatedAt",
          "FindingID": "FindingId",
          "FindingName": "FindingName",
          "Mitigations": "Mitigations",
          "OrganizationID": "OrganizationId",
          "Severity": "Severity",
          "State": "State"
        },
        "description": "Creates an incident for each Low severity finding reported by XBOW that is currently\nin an open state. These findings represent minor security issues or best-practice\nviolations that should be addressed as part of regular security maintenance. Each\nalert is deduplicated per finding so re-ingestion of the same finding does not\nproduce duplicate incidents.\n",
        "displayName": "XbowLowFindings",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "StartUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "FindingID"
            ],
            "lookbackDuration": "PT24H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowLowFindings.yaml",
        "query": "XbowFindings_CL\n| where TimeGenerated > ago(2h)\n| where tolower(Severity) == 'low'\n| where isempty(State) or tolower(State) == 'open'\n| summarize arg_max(TimeGenerated, *) by FindingId\n| join kind=leftouter (\n    XbowAssets_CL\n    | summarize arg_max(TimeGenerated, *) by AssetId\n    | project AssetId, StartUrl\n) on AssetId\n| project\n    TimeGenerated,\n    FindingId,\n    FindingName,\n    Severity,\n    State,\n    Summary,\n    Impact,\n    Mitigations,\n    Recipe,\n    AssetId,\n    AssetName,\n    OrganizationId,\n    CreatedAt,\n    StartUrl\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT2H",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery"
        ],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}