GTI - Insider Threat Alert Detected | Microsoft Sentinel Analytic Rules

Back


Id	e5f6a7b8-c9d0-1234-efab-345678901234
Rulename	GTI - Insider Threat Alert Detected
Description	Triggers an incident when a GTI Relevance System Alert of type insider_threat is ingested. Insider Threat alerts indicate that GTI has identified intelligence suggesting malicious or negligent activity by individuals with legitimate access to your organisation - such as employee credential sales, internal data exposure, or rogue employee activity observed in underground sources. Each unique Alert ID is grouped into a single incident.
Severity	High
Tactics	PrivilegeEscalation Exfiltration CredentialAccess Impact
Techniques	T1068 T1078 T1567 T1552 T1485
Required data connectors	GoogleThreatIntelligenceRelevanceSystemAlertsAPI
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_InsiderThreatAlerts.yaml
Version	1.0.0
Arm template	e5f6a7b8-c9d0-1234-efab-345678901234.json

KQL

GTIRelevanceSystemAlerts
| where DetailType == "insider_threat"
| project
    TimeGenerated,
    AlertId,
    AlertName           = DisplayName,
    AlertState          = State,
    InsiderSeverity     = InsiderThreatSeverity,
    DiscoveryDocuments  = InsiderThreatDiscoveryDocumentIds,
    PriorityLevel,
    PriorityReasoning,
    SeverityLevel,
    SeverityConfidence,
    SeverityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    CommonThemes        = RelevanceEvidenceCommonThemes,
    DistinctThemes      = RelevanceEvidenceDistinctThemes,
    AuditCreateTime,
    AuditUpdateTime

YAML

requiredDataConnectors:
- dataTypes:
  - RelevanceSystemAlerts_CL
  connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_InsiderThreatAlerts.yaml
version: 1.0.0
status: Available
alertDetailsOverride:
  alertDescriptionFormat: |
    Insider Severity: {{InsiderSeverity}} | Priority: {{PriorityLevel}}

    Summary: {{AiSummary}}
  alertDisplayNameFormat: 'GTI Insider Threat: {{AlertName}}'
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: P5D
    matchingMethod: Selected
    reopenClosedIncident: false
    enabled: true
    groupByCustomDetails:
    - AlertId
  createIncident: true
queryFrequency: 5m
query: |
  GTIRelevanceSystemAlerts
  | where DetailType == "insider_threat"
  | project
      TimeGenerated,
      AlertId,
      AlertName           = DisplayName,
      AlertState          = State,
      InsiderSeverity     = InsiderThreatSeverity,
      DiscoveryDocuments  = InsiderThreatDiscoveryDocumentIds,
      PriorityLevel,
      PriorityReasoning,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      CommonThemes        = RelevanceEvidenceCommonThemes,
      DistinctThemes      = RelevanceEvidenceDistinctThemes,
      AuditCreateTime,
      AuditUpdateTime
tactics:
- PrivilegeEscalation
- Exfiltration
- CredentialAccess
- Impact
relevantTechniques:
- T1068
- T1078
- T1567
- T1552
- T1485
id: e5f6a7b8-c9d0-1234-efab-345678901234
triggerThreshold: 0
triggerOperator: gt
name: GTI - Insider Threat Alert Detected
queryPeriod: 5m
severity: High
customDetails:
  RelevanceLevel: RelevanceLevel
  FindingCount: FindingCount
  AlertId: AlertId
  InsiderSeverity: InsiderSeverity
  SeverityLevel: SeverityLevel
  AlertState: AlertState
  PriorityLevel: PriorityLevel
kind: Scheduled
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |
  Triggers an incident when a GTI Relevance System Alert of type insider_threat is ingested.
  Insider Threat alerts indicate that GTI has identified intelligence suggesting malicious or negligent
  activity by individuals with legitimate access to your organisation - such as employee credential
  sales, internal data exposure, or rogue employee activity observed in underground sources.
  Each unique Alert ID is grouped into a single incident.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e5f6a7b8-c9d0-1234-efab-345678901234')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e5f6a7b8-c9d0-1234-efab-345678901234')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Insider Severity: {{InsiderSeverity}} | Priority: {{PriorityLevel}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI Insider Threat: {{AlertName}}"
        },
        "alertRuleTemplateName": "e5f6a7b8-c9d0-1234-efab-345678901234",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "FindingCount": "FindingCount",
          "InsiderSeverity": "InsiderSeverity",
          "PriorityLevel": "PriorityLevel",
          "RelevanceLevel": "RelevanceLevel",
          "SeverityLevel": "SeverityLevel"
        },
        "description": "Triggers an incident when a GTI Relevance System Alert of type insider_threat is ingested.\nInsider Threat alerts indicate that GTI has identified intelligence suggesting malicious or negligent\nactivity by individuals with legitimate access to your organisation - such as employee credential\nsales, internal data exposure, or rogue employee activity observed in underground sources.\nEach unique Alert ID is grouped into a single incident.\n",
        "displayName": "GTI - Insider Threat Alert Detected",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_InsiderThreatAlerts.yaml",
        "query": "GTIRelevanceSystemAlerts\n| where DetailType == \"insider_threat\"\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName           = DisplayName,\n    AlertState          = State,\n    InsiderSeverity     = InsiderThreatSeverity,\n    DiscoveryDocuments  = InsiderThreatDiscoveryDocumentIds,\n    PriorityLevel,\n    PriorityReasoning,\n    SeverityLevel,\n    SeverityConfidence,\n    SeverityReasoning,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    FindingCount,\n    AiSummary,\n    CommonThemes        = RelevanceEvidenceCommonThemes,\n    DistinctThemes      = RelevanceEvidenceDistinctThemes,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Exfiltration",
          "Impact",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1068",
          "T1078",
          "T1485",
          "T1552",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}