GTI - High Relevance Alert Detected | Microsoft Sentinel Analytic Rules

Back


Id	f6a7b8c9-d0e1-2345-fabc-456789012345
Rulename	GTI - High Relevance Alert Detected
Description	Triggers an incident when a GTI Relevance System Alert is assessed as RELEVANCE_LEVEL_HIGH with a HIGH confidence level. High relevance means Google Threat Intelligence has determined the threat directly or very closely matches your organisation profile - regardless of threat type. These are the most actionable alerts and warrant priority investigation. Each unique Alert ID is grouped into a single incident.
Severity	High
Tactics	InitialAccess Exfiltration Impact CredentialAccess PrivilegeEscalation
Techniques	T1566 T1068 T1078 T1567 T1486 T1552
Required data connectors	GoogleThreatIntelligenceRelevanceSystemAlertsAPI
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_HighRelevanceAlerts.yaml
Version	1.0.0
Arm template	f6a7b8c9-d0e1-2345-fabc-456789012345.json

KQL

GTIRelevanceSystemAlerts
| where RelevanceLevel == "HIGH"
    and IsRelevant == true
| extend
    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
| project
    TimeGenerated,
    AlertId,
    AlertName           = DisplayName,
    AlertState          = State,
    DetailType,
    DetailSeverity,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    CommonThemes        = RelevanceEvidenceCommonThemes,
    DistinctThemes      = RelevanceEvidenceDistinctThemes,
    SeverityLevel,
    SeverityConfidence,
    SeverityReasoning,
    PriorityLevel,
    PriorityReasoning,
    FindingCount,
    AiSummary,
    AuditCreateTime,
    AuditUpdateTime

YAML

requiredDataConnectors:
- dataTypes:
  - RelevanceSystemAlerts_CL
  connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_HighRelevanceAlerts.yaml
version: 1.0.0
status: Available
alertDetailsOverride:
  alertDescriptionFormat: |
    Relevance: {{RelevanceLevel}}

    Why it matches your organisation:
    {{RelevanceReasoning}}

    Summary: {{AiSummary}}
  alertDisplayNameFormat: 'GTI High Relevance Alert: {{AlertName}}'
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: P5D
    matchingMethod: Selected
    reopenClosedIncident: false
    enabled: true
    groupByCustomDetails:
    - AlertId
  createIncident: true
queryFrequency: 5m
query: |
  GTIRelevanceSystemAlerts
  | where RelevanceLevel == "HIGH"
      and IsRelevant == true
  | extend
      DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
  | project
      TimeGenerated,
      AlertId,
      AlertName           = DisplayName,
      AlertState          = State,
      DetailType,
      DetailSeverity,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      CommonThemes        = RelevanceEvidenceCommonThemes,
      DistinctThemes      = RelevanceEvidenceDistinctThemes,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      PriorityLevel,
      PriorityReasoning,
      FindingCount,
      AiSummary,
      AuditCreateTime,
      AuditUpdateTime
tactics:
- InitialAccess
- Exfiltration
- Impact
- CredentialAccess
- PrivilegeEscalation
relevantTechniques:
- T1566
- T1068
- T1078
- T1567
- T1486
- T1552
id: f6a7b8c9-d0e1-2345-fabc-456789012345
triggerThreshold: 0
triggerOperator: gt
name: GTI - High Relevance Alert Detected
queryPeriod: 5m
severity: High
customDetails:
  DetailType: DetailType
  RelevanceLevel: RelevanceLevel
  FindingCount: FindingCount
  AlertId: AlertId
  RelevanceConfidence: RelevanceConfidence
  AlertState: AlertState
  SeverityLevel: SeverityLevel
  PriorityLevel: PriorityLevel
kind: Scheduled
eventGroupingSettings:
  aggregationKind: AlertPerResult
description: |
  Triggers an incident when a GTI Relevance System Alert is assessed as RELEVANCE_LEVEL_HIGH
  with a HIGH confidence level. High relevance means Google Threat Intelligence has determined
  the threat directly or very closely matches your organisation profile - regardless of threat type.
  These are the most actionable alerts and warrant priority investigation.
  Each unique Alert ID is grouped into a single incident.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f6a7b8c9-d0e1-2345-fabc-456789012345')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f6a7b8c9-d0e1-2345-fabc-456789012345')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Relevance: {{RelevanceLevel}}\n\nWhy it matches your organisation:\n{{RelevanceReasoning}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI High Relevance Alert: {{AlertName}}"
        },
        "alertRuleTemplateName": "f6a7b8c9-d0e1-2345-fabc-456789012345",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "DetailType": "DetailType",
          "FindingCount": "FindingCount",
          "PriorityLevel": "PriorityLevel",
          "RelevanceConfidence": "RelevanceConfidence",
          "RelevanceLevel": "RelevanceLevel",
          "SeverityLevel": "SeverityLevel"
        },
        "description": "Triggers an incident when a GTI Relevance System Alert is assessed as RELEVANCE_LEVEL_HIGH\nwith a HIGH confidence level. High relevance means Google Threat Intelligence has determined\nthe threat directly or very closely matches your organisation profile - regardless of threat type.\nThese are the most actionable alerts and warrant priority investigation.\nEach unique Alert ID is grouped into a single incident.\n",
        "displayName": "GTI - High Relevance Alert Detected",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_HighRelevanceAlerts.yaml",
        "query": "GTIRelevanceSystemAlerts\n| where RelevanceLevel == \"HIGH\"\n    and IsRelevant == true\n| extend\n    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, \"\")\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName           = DisplayName,\n    AlertState          = State,\n    DetailType,\n    DetailSeverity,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    CommonThemes        = RelevanceEvidenceCommonThemes,\n    DistinctThemes      = RelevanceEvidenceDistinctThemes,\n    SeverityLevel,\n    SeverityConfidence,\n    SeverityReasoning,\n    PriorityLevel,\n    PriorityReasoning,\n    FindingCount,\n    AiSummary,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Exfiltration",
          "Impact",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1068",
          "T1078",
          "T1486",
          "T1552",
          "T1566",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}