Tanium Threat Response Alerts
Id | dd9aa0ff-7ac1-4448-879c-e1a18d5890b4 |
Rulename | Tanium Threat Response Alerts |
Description | Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook |
Severity | High |
Kind | Scheduled |
Query frequency | 5m |
Query period | 6m |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml |
Version | 1.1.0 |
Arm template | dd9aa0ff-7ac1-4448-879c-e1a18d5890b4.json |
let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1)) };
TaniumThreatResponse_CL
| extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
| extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
| where Computer_IP_s !contains "N/A"
queryFrequency: 5m
description: Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook
name: Tanium Threat Response Alerts
relevantTechniques: []
triggerThreshold: 0
id: dd9aa0ff-7ac1-4448-879c-e1a18d5890b4
requiredDataConnectors: []
entityMappings:
- entityType: URL
fieldMappings:
- identifier: Url
columnName: TaniumUrl
- entityType: IP
fieldMappings:
- identifier: Address
columnName: Computer_IP_s
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Computer_Name_s
- entityType: Malware
fieldMappings:
- identifier: Name
columnName: TaniumTHRLabel
queryPeriod: 6m
query: |
let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1)) };
TaniumThreatResponse_CL
| extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
| extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
| where Computer_IP_s !contains "N/A"
kind: Scheduled
severity: High
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml
version: 1.1.0
triggerOperator: gt
tactics: []
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dd9aa0ff-7ac1-4448-879c-e1a18d5890b4')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dd9aa0ff-7ac1-4448-879c-e1a18d5890b4')]",
"properties": {
"alertRuleTemplateName": "dd9aa0ff-7ac1-4448-879c-e1a18d5890b4",
"customDetails": null,
"description": "Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook",
"displayName": "Tanium Threat Response Alerts",
"enabled": true,
"entityMappings": [
{
"entityType": "URL",
"fieldMappings": [
{
"columnName": "TaniumUrl",
"identifier": "Url"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "Computer_IP_s",
"identifier": "Address"
}
]
},
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "Computer_Name_s",
"identifier": "HostName"
}
]
},
{
"entityType": "Malware",
"fieldMappings": [
{
"columnName": "TaniumTHRLabel",
"identifier": "Name"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml",
"query": "let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1)) };\nTaniumThreatResponse_CL\n| extend TaniumUrl = pack(\"computer_name\", Computer_Name_s, \"alert_guid\", Alert_Id_g, \"ip_address\", Computer_IP_s, \"platform\", Match_Details_finding_system_info_platform_s)\n| extend TaniumTHRLabel = strcat(cap(Intel_Type_s),\" - \", cap(Intel_Name_s), \" - \", cap(Match_Details_match_type_s))\n| where Computer_IP_s !contains \"N/A\"\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT6M",
"severity": "High",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [],
"techniques": [],
"templateVersion": "1.1.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}