ThreatConnect TI map IP entity to Network Session Events ASIM Network Session schema

Back


Id	ee1fd303-2081-47b7-8f02-e38bfd0868e6
Rulename	ThreatConnect TI map IP entity to Network Session Events (ASIM Network Session schema)
Description	ThreatConnect Specific: This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schema
Severity	Medium
Tactics	CommandAndControl
Techniques	T1071
Required data connectors	ThreatIntelligence
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ThreatConnect/Analytic Rules/ThreatConnect_IPEntity_NetworkSessions.yaml
Version	1.0.2
Arm template	ee1fd303-2081-47b7-8f02-e38bfd0868e6.json

KQL

let dt_lookBack = 1h;
let ioc_lookBack = 14d;
let IP_TI = materialize (
  ThreatIntelligenceIndicator
  | where TimeGenerated >= ago(ioc_lookBack)
  | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
  | where ExpirationDateTime > now() and Active == true
  | where SourceSystem startswith "ThreatConnect-"
  | extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP,EmailSourceIpAddress,"NO_IP")
  | where TI_ipEntity != "NO_IP"
);
IP_TI
  // using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
| join kind=innerunique 
(
  _Im_NetworkSession (starttime=ago(dt_lookBack))
  | where isnotempty(SrcIpAddr)
  | summarize imNWS_mintime=min(TimeGenerated), imNWS_maxtime=max(TimeGenerated) by SrcIpAddr, DstIpAddr, Dvc, EventProduct, EventVendor  
  | lookup (IP_TI | project TI_ipEntity, Active) on $left.SrcIpAddr == $right.TI_ipEntity
  | project-rename SrcMatch = Active
  | lookup (IP_TI | project TI_ipEntity, Active) on $left.DstIpAddr == $right.TI_ipEntity
  | project-rename DstMatch = Active
  | where SrcMatch or DstMatch
  | extend 
      IoCIP = iff(SrcMatch, SrcIpAddr, DstIpAddr),
      IoCDirection = iff(SrcMatch, "Source", "Destination")
)on $left.TI_ipEntity == $right.IoCIP
| where imNWS_mintime < ExpirationDateTime
| project imNWS_mintime, imNWS_maxtime, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SrcIpAddr, DstIpAddr, IoCDirection, IoCIP, Dvc, EventVendor, EventProduct

YAML

tactics:
- CommandAndControl
eventGroupingSettings:
  aggregationKind: SingleAlert
suppressionDuration: 1h
queryPeriod: 14d
customDetails:
  IoCDescription: Description
  IoCExpirationTime: ExpirationDateTime
  IoCIPDirection: IoCDirection
  EventStartTime: imNWS_mintime
  ActivityGroupNames: ActivityGroupNames
  EventEndTime: imNWS_maxtime
  IndicatorId: IndicatorId
  IoCConfidenceScore: ConfidenceScore
  ThreatType: ThreatType
suppressionEnabled: false
entityMappings:
- fieldMappings:
  - identifier: Address
    columnName: IoCIP
  entityType: IP
alertDetailsOverride:
  alertDescriptionFormat: The {{IoCDirection}} address {{IoCIP}} of a network session  matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blead for more information on the indicator.
  alertDisplayNameFormat: A network session {{IoCDirection}} address {{IoCIP}} matched an IoC.
relevantTechniques:
- T1071
triggerThreshold: 0
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ThreatConnect/Analytic Rules/ThreatConnect_IPEntity_NetworkSessions.yaml
triggerOperator: gt
kind: Scheduled
version: 1.0.2
query: |
  let dt_lookBack = 1h;
  let ioc_lookBack = 14d;
  let IP_TI = materialize (
    ThreatIntelligenceIndicator
    | where TimeGenerated >= ago(ioc_lookBack)
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId
    | where ExpirationDateTime > now() and Active == true
    | where SourceSystem startswith "ThreatConnect-"
    | extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP,EmailSourceIpAddress,"NO_IP")
    | where TI_ipEntity != "NO_IP"
  );
  IP_TI
    // using innerunique to keep perf fast and result set low, we only need one match to indicate potential malicious activity that needs to be investigated
  | join kind=innerunique 
  (
    _Im_NetworkSession (starttime=ago(dt_lookBack))
    | where isnotempty(SrcIpAddr)
    | summarize imNWS_mintime=min(TimeGenerated), imNWS_maxtime=max(TimeGenerated) by SrcIpAddr, DstIpAddr, Dvc, EventProduct, EventVendor  
    | lookup (IP_TI | project TI_ipEntity, Active) on $left.SrcIpAddr == $right.TI_ipEntity
    | project-rename SrcMatch = Active
    | lookup (IP_TI | project TI_ipEntity, Active) on $left.DstIpAddr == $right.TI_ipEntity
    | project-rename DstMatch = Active
    | where SrcMatch or DstMatch
    | extend 
        IoCIP = iff(SrcMatch, SrcIpAddr, DstIpAddr),
        IoCDirection = iff(SrcMatch, "Source", "Destination")
  )on $left.TI_ipEntity == $right.IoCIP
  | where imNWS_mintime < ExpirationDateTime
  | project imNWS_mintime, imNWS_maxtime, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, SrcIpAddr, DstIpAddr, IoCDirection, IoCIP, Dvc, EventVendor, EventProduct  
requiredDataConnectors:
- connectorId: ThreatIntelligence
  dataTypes:
  - ThreatIntelligenceIndicator
id: ee1fd303-2081-47b7-8f02-e38bfd0868e6
name: ThreatConnect TI map IP entity to Network Session Events (ASIM Network Session schema)
severity: Medium
description: |-
  ThreatConnect Specific:
  This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC.
  This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema  
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    enabled: true
    lookbackDuration: 4h
  createIncident: true

ARM