Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Tanium Threat Response Alerts

Back
Iddd9aa0ff-7ac1-4448-879c-e1a18d5890b4
RulenameTanium Threat Response Alerts
DescriptionAlerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook
SeverityHigh
KindScheduled
Query frequency5m
Query period6m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml
Version1.2.0
Arm templatedd9aa0ff-7ac1-4448-879c-e1a18d5890b4.json
Deploy To Azure
let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1))  };
TaniumThreatResponse_CL
| extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
| extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
| where Computer_IP_s !contains "N/A"
tactics: []
name: Tanium Threat Response Alerts
id: dd9aa0ff-7ac1-4448-879c-e1a18d5890b4
requiredDataConnectors: []
query: |
  let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1))  };
  TaniumThreatResponse_CL
  | extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
  | extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
  | where Computer_IP_s !contains "N/A"  
eventGroupingSettings:
  aggregationKind: AlertPerResult
relevantTechniques: []
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    lookbackDuration: PT5H
    enabled: false
description: Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook
triggerOperator: gt
queryPeriod: 6m
severity: High
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: TaniumUrl
  entityType: URL
- fieldMappings:
  - identifier: Address
    columnName: Computer_IP_s
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: Computer_Name_s
  entityType: Host
- fieldMappings:
  - identifier: Name
    columnName: TaniumTHRLabel
  entityType: Malware
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml
version: 1.2.0
alertDetailsOverride:
  alertDisplayNameFormat: '{{TaniumTHRLabel}}'
  alertDescriptionFormat: 'Alert from Tanium Threat Response. GUID: {{Alert_Id_g}}; Computer Name: {{Computer_Name_s}}; IP: {{Computer_IP_s}}'
triggerThreshold: 0
kind: Scheduled
queryFrequency: 5m
customDetails:
  IntelId: Intel_Id_d
  TaniumAlertId: Alert_Id_g
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dd9aa0ff-7ac1-4448-879c-e1a18d5890b4')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dd9aa0ff-7ac1-4448-879c-e1a18d5890b4')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Alert from Tanium Threat Response. GUID: {{Alert_Id_g}}; Computer Name: {{Computer_Name_s}}; IP: {{Computer_IP_s}}",
          "alertDisplayNameFormat": "{{TaniumTHRLabel}}"
        },
        "alertRuleTemplateName": "dd9aa0ff-7ac1-4448-879c-e1a18d5890b4",
        "customDetails": {
          "IntelId": "Intel_Id_d",
          "TaniumAlertId": "Alert_Id_g"
        },
        "description": "Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook",
        "displayName": "Tanium Threat Response Alerts",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "TaniumUrl",
                "identifier": "Url"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "Computer_IP_s",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "Computer_Name_s",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Malware",
            "fieldMappings": [
              {
                "columnName": "TaniumTHRLabel",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml",
        "query": "let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1))  };\nTaniumThreatResponse_CL\n| extend TaniumUrl = pack(\"computer_name\", Computer_Name_s, \"alert_guid\", Alert_Id_g, \"ip_address\", Computer_IP_s, \"platform\", Match_Details_finding_system_info_platform_s)\n| extend TaniumTHRLabel = strcat(cap(Intel_Type_s),\" - \", cap(Intel_Name_s), \" - \", cap(Match_Details_match_type_s))\n| where Computer_IP_s !contains \"N/A\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT6M",
        "severity": "High",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.2.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}