Illumio VEN Offline Detection Rule

Back


Id	ec07fcd3-724f-426d-9f53-041801ca5f6c
Rulename	Illumio VEN Offline Detection Rule
Description	Create Microsoft Sentinel Incident When Ven Goes Into Offline state
Severity	High
Tactics	DefenseEvasion
Techniques	T1562
Required data connectors	IllumioSaaSDataConnector SyslogAma
Kind	Scheduled
Query frequency	60m
Query period	60m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml
Version	1.0.7
Arm template	ec07fcd3-724f-426d-9f53-041801ca5f6c.json

KQL

Illumio_Auditable_Events_CL
| union IllumioSyslogAuditEvents    
| where event_type has 'agent_offline_check'
| mv-expand resource_changes
| extend hostname = resource_changes['resource']['workload']['hostname'],
    workload_href = resource_changes['resource']['workload']['href'],
    workload_labels = resource_changes['resource']['workload']['labels']
| project-away resource_changes, version, notifications, action, severity, status // action field will have filtered ip addr, so no point of using IP entity

YAML

description: |
    'Create Microsoft Sentinel Incident When Ven Goes Into Offline state'
status: Available
queryPeriod: 60m
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml
id: ec07fcd3-724f-426d-9f53-041801ca5f6c
kind: Scheduled
requiredDataConnectors:
- connectorId: IllumioSaaSDataConnector
  dataTypes:
  - Illumio_Auditable_Events_CL
- connectorId: SyslogAma
  datatypes:
  - Syslog
tactics:
- DefenseEvasion
severity: High
triggerOperator: gt
version: 1.0.7
query: |
  Illumio_Auditable_Events_CL
  | union IllumioSyslogAuditEvents    
  | where event_type has 'agent_offline_check'
  | mv-expand resource_changes
  | extend hostname = resource_changes['resource']['workload']['hostname'],
      workload_href = resource_changes['resource']['workload']['href'],
      workload_labels = resource_changes['resource']['workload']['labels']
  | project-away resource_changes, version, notifications, action, severity, status // action field will have filtered ip addr, so no point of using IP entity  
eventGroupingSettings:
  aggregationKind: SingleAlert
name: Illumio VEN Offline Detection Rule
queryFrequency: 60m
alertDetailsOverride:
  alertDescriptionFormat: |
        Illumio VEN Offline Incident for {{hostname}} generated at {{TimeGenerated}}
  alertDisplayNameFormat: |
        Illumio VEN Offline Incident for {{hostname}}
relevantTechniques:
- T1562
entityMappings:
- fieldMappings:
  - columnName: hostname
    identifier: HostName
  entityType: Host

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ec07fcd3-724f-426d-9f53-041801ca5f6c')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ec07fcd3-724f-426d-9f53-041801ca5f6c')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Illumio VEN Offline Incident for {{hostname}} generated at {{TimeGenerated}}\n",
          "alertDisplayNameFormat": "Illumio VEN Offline Incident for {{hostname}}\n"
        },
        "alertRuleTemplateName": "ec07fcd3-724f-426d-9f53-041801ca5f6c",
        "customDetails": null,
        "description": "'Create Microsoft Sentinel Incident When Ven Goes Into Offline state'\n",
        "displayName": "Illumio VEN Offline Detection Rule",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "hostname",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml",
        "query": "Illumio_Auditable_Events_CL\n| union IllumioSyslogAuditEvents    \n| where event_type has 'agent_offline_check'\n| mv-expand resource_changes\n| extend hostname = resource_changes['resource']['workload']['hostname'],\n    workload_href = resource_changes['resource']['workload']['href'],\n    workload_labels = resource_changes['resource']['workload']['labels']\n| project-away resource_changes, version, notifications, action, severity, status // action field will have filtered ip addr, so no point of using IP entity\n",
        "queryFrequency": "PT60M",
        "queryPeriod": "PT60M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.7",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}