Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

SSG_Security_Incidents

Back
Idd41fa731-45a2-4b23-bb1d-29896fbc5298
RulenameSSG_Security_Incidents
DescriptionThe security analytic rule is designed to scrutinize network activity involving private IP addresses within an organization’s internal network. By filtering log entries to include only those where either the source or the destination IP is private, the rule focuses on internal communications that could indicate unauthorized access, internal threats, or other security anomalies.
SeverityHIGH
TacticsImpact
TechniquesT1486
KindNRT
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SINEC Security Guard/Analytic Rules/SSG_Azure_Sentinel_analytic_rule.yaml
Version1.0.0
Arm templated41fa731-45a2-4b23-bb1d-29896fbc5298.json
Deploy To Azure
SINECSecurityGuard_CL
| where ipv4_is_private(source_ip) or ipv4_is_private(destination_ip)
| project source_ip, destination_ip, signature_id, signature_name
suppressionEnabled: false
alertDetailsOverride:
  alertDisplayNameFormat: '{{signature_name}} '
  alertDescriptionFormat: 'Alert {{signature_name}} generated from {{source_ip}} to {{destination_ip}} '
  alertDynamicProperties: []
suppressionDuration: 5h
severity: HIGH
id: d41fa731-45a2-4b23-bb1d-29896fbc5298
relevantTechniques:
- T1486
name: SSG_Security_Incidents
customDetails:
  Source_IP: source_ip
kind: NRT
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByAlertDetails: []
    groupByCustomDetails:
    - Source_IP
    matchingMethod: AnyAlert
    reopenClosedIncident: false
    groupByEntities:
    - IP
    enabled: true
    lookbackDuration: 5m
query: |
  SINECSecurityGuard_CL
  | where ipv4_is_private(source_ip) or ipv4_is_private(destination_ip)
  | project source_ip, destination_ip, signature_id, signature_name  
tactics:
- Impact
version: 1.0.0
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: source_ip
    identifier: Address
- entityType: IP
  fieldMappings:
  - columnName: destination_ip
    identifier: Address
description: The security analytic rule is designed to scrutinize network activity involving private IP addresses within an organization's internal network. By filtering log entries to include only those where either the source or the destination IP is private, the rule focuses on internal communications that could indicate unauthorized access, internal threats, or other security anomalies.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SINEC Security Guard/Analytic Rules/SSG_Azure_Sentinel_analytic_rule.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/d41fa731-45a2-4b23-bb1d-29896fbc5298')]",
      "kind": "NRT",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/d41fa731-45a2-4b23-bb1d-29896fbc5298')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Alert {{signature_name}} generated from {{source_ip}} to {{destination_ip}} ",
          "alertDisplayNameFormat": "{{signature_name}} ",
          "alertDynamicProperties": []
        },
        "alertRuleTemplateName": "d41fa731-45a2-4b23-bb1d-29896fbc5298",
        "customDetails": {
          "Source_IP": "source_ip"
        },
        "description": "The security analytic rule is designed to scrutinize network activity involving private IP addresses within an organization's internal network. By filtering log entries to include only those where either the source or the destination IP is private, the rule focuses on internal communications that could indicate unauthorized access, internal threats, or other security anomalies.",
        "displayName": "SSG_Security_Incidents",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "source_ip",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "destination_ip",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [
              "Source_IP"
            ],
            "groupByEntities": [
              "IP"
            ],
            "lookbackDuration": "PT5M",
            "matchingMethod": "AnyAlert",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SINEC Security Guard/Analytic Rules/SSG_Azure_Sentinel_analytic_rule.yaml",
        "query": "SINECSecurityGuard_CL\n| where ipv4_is_private(source_ip) or ipv4_is_private(destination_ip)\n| project source_ip, destination_ip, signature_id, signature_name\n",
        "severity": "HIGH",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact"
        ],
        "techniques": [
          "T1486"
        ],
        "templateVersion": "1.0.0"
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}