Digital Shadows Incident Creation for include-app

Back


Id	ede3071d-9317-45f9-b36c-6a6effee5294
Rulename	Digital Shadows Incident Creation for include-app
Description	Digital Shadows Analytic rule for generating Microsoft Sentinel incidents for the data ingested by app polling for included classifications
Severity	Medium
Required data connectors	DigitalShadows
Kind	Scheduled
Query frequency	5m
Query period	6m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Shadows/Analytic Rules/Digital_Shadows_incident_creation_include.yaml
Version	1.0.2
Arm template	ede3071d-9317-45f9-b36c-6a6effee5294.json

KQL

let DSSearchLight_view  = view () { DigitalShadows_CL | where app_s == "include" | extend EventVendor="Digital Shadows", EventProduct="SearchLight",Type="DigitalShadows_CL",EventStartTime=raised_t,EventMessage=title_s,EventOriginalUid=triage_id_g,EventOriginalType=classification_s | extend EventOriginalSeverity=iif(isempty(risk_level_s), risk_assessment_risk_level_s, risk_level_s) | extend EventSeverity = case(EventOriginalSeverity == 'none', 'Informational', EventOriginalSeverity == 'very-low', 'Low',EventOriginalSeverity == 'low', 'Low',EventOriginalSeverity == 'medium', 'Medium',EventOriginalSeverity == 'high', 'High',EventOriginalSeverity == 'very-high', 'High','Informational') | extend EventReportUrl=iif(isempty(id_d), strcat('https://portal-digitalshadows.com/triage/alerts/',portal_id_s),strcat('https://portal-digitalshadows.com/triage/alert-incidents/',id_d)) | extend AdditionalFields = pack("assets", assets_s, "comments", comments_s, "description", description_s, "incident_id", id_d, "alert_id", id_g, "short_code", portal_id_s, "impact", impact_description_s, "mitigation", mitigation_s, "risk_factors", risk_factors_s, "triage_status", status_s, "triage_id", triage_id_g, "triage_raised", triage_raised_time_t,"triage_updated", triage_updated_time_t, "updated", updated_t) | project TimeGenerated, EventVendor,EventProduct, Type, EventStartTime,EventMessage, EventOriginalUid, EventOriginalType,EventOriginalSeverity, EventSeverity, EventReportUrl,AdditionalFields};DSSearchLight_view | summarize arg_max(TimeGenerated, *) by EventOriginalUid | extend description = AdditionalFields.description | extend impact = AdditionalFields.impact | extend mitigation = AdditionalFields.mitigation | extend status = AdditionalFields.triage_status | extend comments = AdditionalFields.comments

YAML

triggerOperator: gt
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 7d
    enabled: true
    groupByAlertDetails: []
    reopenClosedIncident: true
    matchingMethod: Selected
    groupByCustomDetails:
    - triage_id
    groupByEntities: []
  createIncident: true
alertRuleTemplateName: 
requiredDataConnectors:
- connectorId: DigitalShadows
  dataTypes:
  - DigitalShadows_CL
relevantTechniques: []
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: EventReportUrl
query: let DSSearchLight_view  = view () { DigitalShadows_CL | where app_s == "include" | extend EventVendor="Digital Shadows", EventProduct="SearchLight",Type="DigitalShadows_CL",EventStartTime=raised_t,EventMessage=title_s,EventOriginalUid=triage_id_g,EventOriginalType=classification_s | extend EventOriginalSeverity=iif(isempty(risk_level_s), risk_assessment_risk_level_s, risk_level_s) | extend EventSeverity = case(EventOriginalSeverity == 'none', 'Informational', EventOriginalSeverity == 'very-low', 'Low',EventOriginalSeverity == 'low', 'Low',EventOriginalSeverity == 'medium', 'Medium',EventOriginalSeverity == 'high', 'High',EventOriginalSeverity == 'very-high', 'High','Informational') | extend EventReportUrl=iif(isempty(id_d), strcat('https://portal-digitalshadows.com/triage/alerts/',portal_id_s),strcat('https://portal-digitalshadows.com/triage/alert-incidents/',id_d)) | extend AdditionalFields = pack("assets", assets_s, "comments", comments_s, "description", description_s, "incident_id", id_d, "alert_id", id_g, "short_code", portal_id_s, "impact", impact_description_s, "mitigation", mitigation_s, "risk_factors", risk_factors_s, "triage_status", status_s, "triage_id", triage_id_g, "triage_raised", triage_raised_time_t,"triage_updated", triage_updated_time_t, "updated", updated_t) | project TimeGenerated, EventVendor,EventProduct, Type, EventStartTime,EventMessage, EventOriginalUid, EventOriginalType,EventOriginalSeverity, EventSeverity, EventReportUrl,AdditionalFields};DSSearchLight_view | summarize arg_max(TimeGenerated, *) by EventOriginalUid | extend description = AdditionalFields.description | extend impact = AdditionalFields.impact | extend mitigation = AdditionalFields.mitigation | extend status = AdditionalFields.triage_status | extend comments = AdditionalFields.comments
triggerThreshold: 0
customDetails:
  status: status
  description: description
  triage_id: EventOriginalUid
  severity: EventOriginalSeverity
  impact: impact
  mitigation: mitigation
alertDetailsOverride:
  alertDisplayNameFormat: Digital Shadows - {{EventMessage}}
  alertSeverityColumnName: EventSeverity
  alertTacticsColumnName: 
  alertDescriptionFormat: |-
    {{description}}

    {{impact}}

    {{mitigation}}    
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Shadows/Analytic Rules/Digital_Shadows_incident_creation_include.yaml
suppressionEnabled: false
queryPeriod: 6m
tactics: []
name: Digital Shadows Incident Creation for include-app
techniques: []
enabled: true
kind: Scheduled
description: Digital Shadows Analytic rule for generating Microsoft Sentinel incidents for the data ingested by app polling for included classifications
id: ede3071d-9317-45f9-b36c-6a6effee5294
version: 1.0.2
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryFrequency: 5m
severity: Medium
suppressionDuration: 5h

ARM