TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0001" and (priority_s == "P1" or priority_s == "P2")
requiredDataConnectors:
- dataTypes:
- TheomAlerts_CL
connectorId: Theom
relevantTechniques:
- T1552
triggerOperator: gt
version: 1.0.2
queryFrequency: 5m
severity: High
triggerThreshold: 0
entityMappings:
- fieldMappings:
- columnName: customProps_AssetName_s
identifier: Name
entityType: CloudApplication
- fieldMappings:
- columnName: deepLink_s
identifier: Url
entityType: URL
alertDetailsOverride:
alertDescriptionFormat: |2
Summary: {{summary_s}}
Additional info: {{details_s}}
Please investigate further on Theom UI at {{deepLink_s}}
alertDisplayNameFormat: 'Theom Alert ID: {{id_s}} '
name: Theom - Dev secrets unencrypted
query: |
TheomAlerts_CL
| where customProps_RuleId_s == "TRIS0001" and (priority_s == "P1" or priority_s == "P2")
tactics:
- CredentialAccess
queryPeriod: 5m
description: |
"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0001 (Developer secrets have been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS requirement)"
kind: Scheduled
id: f2490f5b-269c-471d-9ff4-475f62ea498e
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TRIS0001_Dev_secrets_unencrypted.yaml
eventGroupingSettings:
aggregationKind: AlertPerResult
status: Available
