Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Awake Security - High Severity Matches By Device

Back
Idd5e012c2-29ba-4a02-a813-37b928aafe2d
RulenameAwake Security - High Severity Matches By Device
DescriptionThis query searches for devices with high severity event(s).
SeverityMedium
Required data connectorsAristaAwakeSecurity
CefAma
KindScheduled
Query frequency1h
Query period1h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AristaAwakeSecurity/Analytic Rules/HighSeverityMatchesByDevice.yaml
Version1.0.1
Arm templated5e012c2-29ba-4a02-a813-37b928aafe2d.json
Deploy To Azure
CommonSecurityLog
| where DeviceVendor == "Arista Networks" and DeviceProduct == "Awake Security" and toint(LogSeverity) > 6
| summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Models=make_set(Activity), ASPMatchURLs=make_set(DeviceCustomString2), SourceIPs=make_set(SourceIP),
  DestinationIPs=make_set(DestinationIP), ModelMatchCount=sum(EventCount), MaxSeverity=max(todecimal  (LogSeverity)) by SourceHostName
tactics: []
query: |
  CommonSecurityLog
  | where DeviceVendor == "Arista Networks" and DeviceProduct == "Awake Security" and toint(LogSeverity) > 6
  | summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Models=make_set(Activity), ASPMatchURLs=make_set(DeviceCustomString2), SourceIPs=make_set(SourceIP),
    DestinationIPs=make_set(DestinationIP), ModelMatchCount=sum(EventCount), MaxSeverity=max(todecimal  (LogSeverity)) by SourceHostName  
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    groupByCustomDetails:
    - Device
    enabled: true
    reopenClosedIncident: true
    matchingMethod: Selected
    groupByEntities:
    - Host
    groupByAlertDetails: []
    lookbackDuration: 3d
queryFrequency: 1h
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: SourceHostName
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: SourceIPs
  entityType: IP
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AristaAwakeSecurity/Analytic Rules/HighSeverityMatchesByDevice.yaml
queryPeriod: 1h
kind: Scheduled
version: 1.0.1
triggerOperator: gt
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available
relevantTechniques: []
name: Awake Security - High Severity Matches By Device
triggerThreshold: 0
severity: Medium
customDetails:
  Matches_ASP_URLs: ASPMatchURLs
  Matches_Max_Severity: MaxSeverity
  Device: SourceHostName
  Matches_Count: ModelMatchCount
  Matched_Models: Models
  Matches_Dest_IPs: DestinationIPs
alertDetailsOverride:
  alertSeverityColumnName: MaxSeverity
  alertDescriptionFormat: |
    Device {{SourceHostName}} matched the following high-severity Awake model(s):

    {{Models}}

    The destination IPs associated with these matches were:

    {{DestinationIPs}}    
  alertTacticsColumnName: 
  alertDisplayNameFormat: Awake Security - High Severity Matches On Device {{SourceHostName}}
description: This query searches for devices with high severity event(s).
requiredDataConnectors:
- dataTypes:
  - CommonSecurityLog (AwakeSecurity)
  connectorId: AristaAwakeSecurity
- dataTypes:
  - CommonSecurityLog
  connectorId: CefAma
id: d5e012c2-29ba-4a02-a813-37b928aafe2d
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/d5e012c2-29ba-4a02-a813-37b928aafe2d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/d5e012c2-29ba-4a02-a813-37b928aafe2d')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Device {{SourceHostName}} matched the following high-severity Awake model(s):\n\n{{Models}}\n\nThe destination IPs associated with these matches were:\n\n{{DestinationIPs}}\n",
          "alertDisplayNameFormat": "Awake Security - High Severity Matches On Device {{SourceHostName}}",
          "alertSeverityColumnName": "MaxSeverity",
          "alertTacticsColumnName": null
        },
        "alertRuleTemplateName": "d5e012c2-29ba-4a02-a813-37b928aafe2d",
        "customDetails": {
          "Device": "SourceHostName",
          "Matched_Models": "Models",
          "Matches_ASP_URLs": "ASPMatchURLs",
          "Matches_Count": "ModelMatchCount",
          "Matches_Dest_IPs": "DestinationIPs",
          "Matches_Max_Severity": "MaxSeverity"
        },
        "description": "This query searches for devices with high severity event(s).",
        "displayName": "Awake Security - High Severity Matches By Device",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SourceHostName",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "SourceIPs",
                "identifier": "Address"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [],
            "groupByCustomDetails": [
              "Device"
            ],
            "groupByEntities": [
              "Host"
            ],
            "lookbackDuration": "P3D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": true
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AristaAwakeSecurity/Analytic Rules/HighSeverityMatchesByDevice.yaml",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Arista Networks\" and DeviceProduct == \"Awake Security\" and toint(LogSeverity) > 6\n| summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Models=make_set(Activity), ASPMatchURLs=make_set(DeviceCustomString2), SourceIPs=make_set(SourceIP),\n  DestinationIPs=make_set(DestinationIP), ModelMatchCount=sum(EventCount), MaxSeverity=max(todecimal  (LogSeverity)) by SourceHostName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}