let ioc_lookBack = 1d;
// The source table (ASimNetworkSessionLogs) can be replaced by any infrastructure table containing ip data.
// The following workbook: Recorded Future - IP Correlation will help researching available data and selecting tables and columns
imNetworkSession
| where isnotempty(DstIpAddr)
| join kind=inner (
ThreatIntelligenceIndicator
// Only look for IOCs
| where isnotempty(NetworkIP)
// Only look at Recorded Future Threat Hunt Indicators.
| where Description startswith "Recorded Future - Threat Hunt"
// Only work with the latest indicators
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
| where Active == true and ExpirationDateTime > now()
) on $left.DstIpAddr == $right.NetworkIP
// select column from the source table to match with Recorded Future ThreatIntelligenceIndicator $left.DstIpAddr
| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)[0]))['RecordedFuturePortalLink']
| project NetworkIP, Description, Type, TimeGenerated, RecordedFuturePortalLink
queryPeriod: 1d
entityMappings:
- fieldMappings:
- columnName: NetworkIP
identifier: Address
entityType: IP
id: e31bc14e-2b4c-42a4-af34-5bfd7d768aea
name: RecordedFuture Threat Hunting IP All Actors
kind: Scheduled
description: |
'Recorded Future Threat Hunting IP correlation for all actors.'
customDetails:
ActorInformation: RecordedFuturePortalLink
incidentConfiguration:
groupingConfiguration:
matchingMethod: AllEntities
enabled: true
reopenClosedIncident: false
lookbackDuration: 1h
createIncident: true
query: |
let ioc_lookBack = 1d;
// The source table (ASimNetworkSessionLogs) can be replaced by any infrastructure table containing ip data.
// The following workbook: Recorded Future - IP Correlation will help researching available data and selecting tables and columns
imNetworkSession
| where isnotempty(DstIpAddr)
| join kind=inner (
ThreatIntelligenceIndicator
// Only look for IOCs
| where isnotempty(NetworkIP)
// Only look at Recorded Future Threat Hunt Indicators.
| where Description startswith "Recorded Future - Threat Hunt"
// Only work with the latest indicators
| where TimeGenerated >= ago(ioc_lookBack)
| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
| where Active == true and ExpirationDateTime > now()
) on $left.DstIpAddr == $right.NetworkIP
// select column from the source table to match with Recorded Future ThreatIntelligenceIndicator $left.DstIpAddr
| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)[0]))['RecordedFuturePortalLink']
| project NetworkIP, Description, Type, TimeGenerated, RecordedFuturePortalLink
queryFrequency: 15m
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingIPAllActors.yaml
requiredDataConnectors:
- dataTypes:
- ThreatIntelligenceIndicator
connectorId: ThreatIntelligenceUploadIndicatorsAPI
triggerOperator: gt
version: 1.0.2
alertDetailsOverride:
alertDynamicProperties:
- alertProperty: AlertLink
value: RecordedFuturePortalLink
alertDisplayNameFormat: '{{Description}}'
alertDescriptionFormat: '**{{Description}}**\n\nCorrelation found on {{NetworkIP}} from the {{Type}} table.\n'
severity: Medium
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2023-02-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e31bc14e-2b4c-42a4-af34-5bfd7d768aea')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e31bc14e-2b4c-42a4-af34-5bfd7d768aea')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "**{{Description}}**\\n\\nCorrelation found on {{NetworkIP}} from the {{Type}} table.\\n",
"alertDisplayNameFormat": "{{Description}}",
"alertDynamicProperties": [
{
"alertProperty": "AlertLink",
"value": "RecordedFuturePortalLink"
}
]
},
"alertRuleTemplateName": "e31bc14e-2b4c-42a4-af34-5bfd7d768aea",
"customDetails": {
"ActorInformation": "RecordedFuturePortalLink"
},
"description": "'Recorded Future Threat Hunting IP correlation for all actors.'\n",
"displayName": "RecordedFuture Threat Hunting IP All Actors",
"enabled": true,
"entityMappings": [
{
"entityType": "IP",
"fieldMappings": [
{
"columnName": "NetworkIP",
"identifier": "Address"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": true,
"lookbackDuration": "PT1H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Recorded Future/Analytic Rules/ThreatHunting/RecordedFutureThreatHuntingIPAllActors.yaml",
"query": "let ioc_lookBack = 1d;\n// The source table (ASimNetworkSessionLogs) can be replaced by any infrastructure table containing ip data.\n// The following workbook: Recorded Future - IP Correlation will help researching available data and selecting tables and columns \nimNetworkSession\n| where isnotempty(DstIpAddr)\n| join kind=inner (\nThreatIntelligenceIndicator\n// Only look for IOCs\n| where isnotempty(NetworkIP)\n// Only look at Recorded Future Threat Hunt Indicators.\n| where Description startswith \"Recorded Future - Threat Hunt\"\n// Only work with the latest indicators \n| where TimeGenerated >= ago(ioc_lookBack)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now()\n) on $left.DstIpAddr == $right.NetworkIP\n// select column from the source table to match with Recorded Future ThreatIntelligenceIndicator $left.DstIpAddr\n| mv-expand RecordedFuturePortalLink=parse_json(tostring(parse_json(Tags)[0]))['RecordedFuturePortalLink']\n| project NetworkIP, Description, Type, TimeGenerated, RecordedFuturePortalLink\n",
"queryFrequency": "PT15M",
"queryPeriod": "P1D",
"severity": "Medium",
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"templateVersion": "1.0.2",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}