Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Tanium Threat Response Alerts

Back
Iddd9aa0ff-7ac1-4448-879c-e1a18d5890b4
RulenameTanium Threat Response Alerts
DescriptionAlerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook
SeverityHigh
KindScheduled
Query frequency5m
Query period6m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml
Version1.1.0
Arm templatedd9aa0ff-7ac1-4448-879c-e1a18d5890b4.json
Deploy To Azure
let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1))  };
TaniumThreatResponse_CL
| extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
| extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
| where Computer_IP_s !contains "N/A"
version: 1.1.0
name: Tanium Threat Response Alerts
queryPeriod: 6m
queryFrequency: 5m
kind: Scheduled
requiredDataConnectors: []
severity: High
description: Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook
query: |
  let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1))  };
  TaniumThreatResponse_CL
  | extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
  | extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
  | where Computer_IP_s !contains "N/A"  
tactics: []
triggerOperator: gt
entityMappings:
- entityType: URL
  fieldMappings:
  - columnName: TaniumUrl
    identifier: Url
- entityType: IP
  fieldMappings:
  - columnName: Computer_IP_s
    identifier: Address
- entityType: Host
  fieldMappings:
  - columnName: Computer_Name_s
    identifier: HostName
- entityType: Malware
  fieldMappings:
  - columnName: TaniumTHRLabel
    identifier: Name
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml
relevantTechniques: []
id: dd9aa0ff-7ac1-4448-879c-e1a18d5890b4
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/dd9aa0ff-7ac1-4448-879c-e1a18d5890b4')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/dd9aa0ff-7ac1-4448-879c-e1a18d5890b4')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01-preview",
      "properties": {
        "displayName": "Tanium Threat Response Alerts",
        "description": "Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook",
        "severity": "High",
        "enabled": true,
        "query": "let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1))  };\nTaniumThreatResponse_CL\n| extend TaniumUrl = pack(\"computer_name\", Computer_Name_s, \"alert_guid\", Alert_Id_g, \"ip_address\", Computer_IP_s, \"platform\", Match_Details_finding_system_info_platform_s)\n| extend TaniumTHRLabel = strcat(cap(Intel_Type_s),\" - \", cap(Intel_Name_s), \" - \", cap(Match_Details_match_type_s))\n| where Computer_IP_s !contains \"N/A\"\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT6M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "alertRuleTemplateName": "dd9aa0ff-7ac1-4448-879c-e1a18d5890b4",
        "customDetails": null,
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "columnName": "TaniumUrl",
                "identifier": "Url"
              }
            ],
            "entityType": "URL"
          },
          {
            "fieldMappings": [
              {
                "columnName": "Computer_IP_s",
                "identifier": "Address"
              }
            ],
            "entityType": "IP"
          },
          {
            "fieldMappings": [
              {
                "columnName": "Computer_Name_s",
                "identifier": "HostName"
              }
            ],
            "entityType": "Host"
          },
          {
            "fieldMappings": [
              {
                "columnName": "TaniumTHRLabel",
                "identifier": "Name"
              }
            ],
            "entityType": "Malware"
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Tanium/Analytic Rules/TaniumThreatResponseAlerts.yaml",
        "templateVersion": "1.1.0"
      }
    }
  ]
}