blacklens Insights

Back


Id	e261b70a-3005-4a1b-a7a2-2c8147fafed7
Rulename	blacklens Insights
Description	Creates incidents from blacklens.io Attack Surface Management alerts ingested into the blacklens_CL table. Alert severity is mapped dynamically from the source data.
Severity	High
Tactics	Reconnaissance ResourceDevelopment InitialAccess CredentialAccess Collection Exfiltration DefenseEvasion CommandAndControl
Techniques	T1595 T1583 T1190 T1110 T1005 T1041 T1562 T1071
Required data connectors	blacklens_io
Kind	NRT
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Blacklens/Analytic Rules/blacklensInsights.yaml
Version	1.0.0
Arm template	e261b70a-3005-4a1b-a7a2-2c8147fafed7.json

KQL

blacklens_CL
| summarize arg_max(TimeGenerated, *) by id
| extend AlertSeverity = case(
    tolower(severity) == "critical", "High",
    tolower(severity) == "high", "High",
    tolower(severity) == "medium", "Medium",
    tolower(severity) == "low", "Low",
    "Informational"
)

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Blacklens/Analytic Rules/blacklensInsights.yaml
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |
    'Creates incidents from blacklens.io Attack Surface Management alerts ingested into the blacklens_CL table. Alert severity is mapped dynamically from the source data.'
suppressionEnabled: false
name: blacklens Insights
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
kind: NRT
requiredDataConnectors:
- connectorId: blacklens_io
  dataTypes:
  - blacklens_CL
suppressionDuration: PT1H
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: link
tactics:
- Reconnaissance
- ResourceDevelopment
- InitialAccess
- CredentialAccess
- Collection
- Exfiltration
- DefenseEvasion
- CommandAndControl
id: e261b70a-3005-4a1b-a7a2-2c8147fafed7
status: Available
version: 1.0.0
query: |
  blacklens_CL
  | summarize arg_max(TimeGenerated, *) by id
  | extend AlertSeverity = case(
      tolower(severity) == "critical", "High",
      tolower(severity) == "high", "High",
      tolower(severity) == "medium", "Medium",
      tolower(severity) == "low", "Low",
      "Informational"
  )  
alertDetailsOverride:
  alertDescriptionFormat: '{{message}}'
  alertDisplayNameFormat: '{{alert_title}}'
  alertSeverityColumnName: AlertSeverity
severity: High
relevantTechniques:
- T1595
- T1583
- T1190
- T1110
- T1005
- T1041
- T1562
- T1071

ARM