BitSight - drop in company ratings
Id | d8844f11-3a36-4b97-9062-1e6d57c00e37 |
Rulename | BitSight - drop in company ratings |
Description | Rule helps to detect when there is a drop of 10% or more in BitSight company ratings. |
Severity | High |
Tactics | Reconnaissance CommandAndControl |
Required data connectors | BitSight |
Kind | Scheduled |
Query frequency | 1d |
Query period | 24h |
Trigger threshold | 0 |
Trigger operator | GreaterThan |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightDropInCompanyRatings.yaml |
Version | 1.0.1 |
Arm template | d8844f11-3a36-4b97-9062-1e6d57c00e37.json |
let timeframe = 24h;
BitSightGraphData
| where ingestion_time() > ago(timeframe)and toint(RatingDifferance) < 0
| extend percentage = -(toreal(RatingDifferance)/toreal(Rating))*100
| where percentage >= 10
| project RatingDate, Rating, CompanyName, percentage
requiredTechniques:
- T1591
- T1090
queryFrequency: 1d
name: BitSight - drop in company ratings
kind: Scheduled
alertDetailsOverride:
alertDisplayNameFormat: 'BitSight : Alert for >10% drop in ratings of {{CompanyName}}.'
alertDescriptionFormat: 'Alert is generated for {{CompanyName}}.\n\nRating Date: {{RatingDate}}\nPercentage Drop: {{percentage}}%'
eventGroupingSettings:
aggregationKind: AlertPerResult
tactics:
- Reconnaissance
- CommandAndControl
incidentConfiguration:
createIncident: false
triggerThreshold: 0
query: |
let timeframe = 24h;
BitSightGraphData
| where ingestion_time() > ago(timeframe)and toint(RatingDifferance) < 0
| extend percentage = -(toreal(RatingDifferance)/toreal(Rating))*100
| where percentage >= 10
| project RatingDate, Rating, CompanyName, percentage
triggerOperator: GreaterThan
customDetails:
CompanyName: CompanyName
CompanyRating: Rating
queryPeriod: 24h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightDropInCompanyRatings.yaml
severity: High
status: Available
id: d8844f11-3a36-4b97-9062-1e6d57c00e37
requiredDataConnectors:
- connectorId: BitSight
dataTypes:
- BitSightGraphData
version: 1.0.1
description: |
'Rule helps to detect when there is a drop of 10% or more in BitSight company ratings.'
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/d8844f11-3a36-4b97-9062-1e6d57c00e37')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/d8844f11-3a36-4b97-9062-1e6d57c00e37')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "Alert is generated for {{CompanyName}}.\\n\\nRating Date: {{RatingDate}}\\nPercentage Drop: {{percentage}}%",
"alertDisplayNameFormat": "BitSight : Alert for >10% drop in ratings of {{CompanyName}}."
},
"alertRuleTemplateName": "d8844f11-3a36-4b97-9062-1e6d57c00e37",
"customDetails": {
"CompanyName": "CompanyName",
"CompanyRating": "Rating"
},
"description": "'Rule helps to detect when there is a drop of 10% or more in BitSight company ratings.'\n",
"displayName": "BitSight - drop in company ratings",
"enabled": true,
"entityMappings": null,
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": false
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightDropInCompanyRatings.yaml",
"query": "let timeframe = 24h;\nBitSightGraphData\n| where ingestion_time() > ago(timeframe)and toint(RatingDifferance) < 0\n| extend percentage = -(toreal(RatingDifferance)/toreal(Rating))*100\n| where percentage >= 10\n| project RatingDate, Rating, CompanyName, percentage\n",
"queryFrequency": "P1D",
"queryPeriod": "PT24H",
"requiredTechniques": [
"T1591",
"T1090"
],
"severity": "High",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"CommandAndControl",
"Reconnaissance"
],
"templateVersion": "1.0.1",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}