XbowNewAssetDiscovered | Microsoft Sentinel Analytic Rules

Back


Id	e4c6a8b2-9d7f-4285-a1e3-6b9c2e4f1a85
Rulename	XbowNewAssetDiscovered
Description	Alerts when a new asset is registered in XBOW for the first time. This is detected by matching assets whose CreatedAt timestamp falls within the current query window, indicating the asset was newly added rather than updated. This helps track shadow IT, new deployments, and any unexpected expansion of the external attack surface.
Severity	Medium
Tactics	Reconnaissance Discovery
Techniques	T1595
Required data connectors	XbowSecurityConnector
Kind	Scheduled
Query frequency	30m
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowNewAssetDiscovered.yaml
Version	1.0.1
Arm template	e4c6a8b2-9d7f-4285-a1e3-6b9c2e4f1a85.json

KQL

XbowAssets_CL
| where TimeGenerated > ago(1h)
// Only match assets created within the query window (new, not updated)
| where todatetime(CreatedAt) > ago(1h)
| summarize arg_max(TimeGenerated, *) by AssetId
| project
    TimeGenerated,
    AssetId,
    AssetName,
    StartUrl,
    Lifecycle,
    Sku,
    OrganizationId,
    CreatedAt,
    UpdatedAt,
    AssetReachableState,
    AssetReachableMessage

YAML

triggerThreshold: 0
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    groupByCustomDetails:
    - AssetID
    matchingMethod: Selected
    enabled: true
    lookbackDuration: 6h
kind: Scheduled
description: |
  Alerts when a new asset is registered in XBOW for the first time. This is detected by
  matching assets whose CreatedAt timestamp falls within the current query window,
  indicating the asset was newly added rather than updated. This helps track shadow IT,
  new deployments, and any unexpected expansion of the external attack surface.
queryFrequency: 30m
triggerOperator: gt
relevantTechniques:
- T1595
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: StartUrl
  entityType: URL
id: e4c6a8b2-9d7f-4285-a1e3-6b9c2e4f1a85
query: |
  XbowAssets_CL
  | where TimeGenerated > ago(1h)
  // Only match assets created within the query window (new, not updated)
  | where todatetime(CreatedAt) > ago(1h)
  | summarize arg_max(TimeGenerated, *) by AssetId
  | project
      TimeGenerated,
      AssetId,
      AssetName,
      StartUrl,
      Lifecycle,
      Sku,
      OrganizationId,
      CreatedAt,
      UpdatedAt,
      AssetReachableState,
      AssetReachableMessage
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'XBOW New Asset: {{AssetName}}'
  alertDescriptionFormat: 'New asset registered in XBOW: {{AssetName}} ({{StartUrl}}). Reachability: {{AssetReachableState}}'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowNewAssetDiscovered.yaml
version: 1.0.1
requiredDataConnectors:
- dataTypes:
  - XbowAssets_CL
  connectorId: XbowSecurityConnector
customDetails:
  StartUrl: StartUrl
  CreatedAt: CreatedAt
  Lifecycle: Lifecycle
  OrganizationID: OrganizationId
  Sku: Sku
  AssetName: AssetName
  AssetID: AssetId
  AssetReachableState: AssetReachableState
tactics:
- Reconnaissance
- Discovery
queryPeriod: 1h
severity: Medium
status: Available
name: XbowNewAssetDiscovered

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e4c6a8b2-9d7f-4285-a1e3-6b9c2e4f1a85')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e4c6a8b2-9d7f-4285-a1e3-6b9c2e4f1a85')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "New asset registered in XBOW: {{AssetName}} ({{StartUrl}}). Reachability: {{AssetReachableState}}",
          "alertDisplayNameFormat": "XBOW New Asset: {{AssetName}}"
        },
        "alertRuleTemplateName": "e4c6a8b2-9d7f-4285-a1e3-6b9c2e4f1a85",
        "customDetails": {
          "AssetID": "AssetId",
          "AssetName": "AssetName",
          "AssetReachableState": "AssetReachableState",
          "CreatedAt": "CreatedAt",
          "Lifecycle": "Lifecycle",
          "OrganizationID": "OrganizationId",
          "Sku": "Sku",
          "StartUrl": "StartUrl"
        },
        "description": "Alerts when a new asset is registered in XBOW for the first time. This is detected by\nmatching assets whose CreatedAt timestamp falls within the current query window,\nindicating the asset was newly added rather than updated. This helps track shadow IT,\nnew deployments, and any unexpected expansion of the external attack surface.\n",
        "displayName": "XbowNewAssetDiscovered",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "StartUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AssetID"
            ],
            "lookbackDuration": "PT6H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowNewAssetDiscovered.yaml",
        "query": "XbowAssets_CL\n| where TimeGenerated > ago(1h)\n// Only match assets created within the query window (new, not updated)\n| where todatetime(CreatedAt) > ago(1h)\n| summarize arg_max(TimeGenerated, *) by AssetId\n| project\n    TimeGenerated,\n    AssetId,\n    AssetName,\n    StartUrl,\n    Lifecycle,\n    Sku,\n    OrganizationId,\n    CreatedAt,\n    UpdatedAt,\n    AssetReachableState,\n    AssetReachableMessage\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Discovery",
          "Reconnaissance"
        ],
        "techniques": [
          "T1595"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}