Google SecOps - Detection Alerts | Microsoft Sentinel Analytic Rules

Back


Id	f6b0c254-8f7d-4a1b-d5c2-0e4a6b9f2d8a
Rulename	Google SecOps - Detection Alerts
Description	Creates one incident per active Google Security Operations detection alert in Microsoft Sentinel. Covers all rule types and severity levels with no additional filtering, providing broad visibility across all Google SecOps alerts. Use alongside focused rules for complete detection coverage.
Severity	Medium
Tactics	InitialAccess DefenseEvasion LateralMovement PrivilegeEscalation CommandAndControl
Techniques	T1078 T1021 T1566
Required data connectors	GSDetectionAlerts
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleSecOps/Analytic%20Rules/GoogleSecOps-DetectionAlerts.yaml
Version	1.0.0
Arm template	f6b0c254-8f7d-4a1b-d5c2-0e4a6b9f2d8a.json

KQL

GoogleSecOpsDetectionAlerts
| where alertState == "ALERTING"

YAML

tactics:
- InitialAccess
- DefenseEvasion
- LateralMovement
- PrivilegeEscalation
- CommandAndControl
requiredDataConnectors:
- dataTypes:
  - DetectionAlerts_CL
  connectorId: GSDetectionAlerts
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: Selected
    groupByCustomDetails:
    - alert_identifier
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
queryPeriod: 10m
kind: Scheduled
severity: Medium
customDetails:
  DetectionType: detectionType
  SourceHostname: varSourceHostname
  RuleId: ruleId
  RuleName: ruleName
  CorrelationIP: varCorrelationIp
  AlertState: alertState
  SourceIP: varSourceIp
  PrincipalIP: varPrincipalIp
  TargetIP: varTargetIp
  Severity: severity
  alert_identifier: id
  SourceUser: varSourceUserUserid
  RiskScore: riskScore
  TargetUser: varTargetUserUserid
  RuleType: ruleType
  PrincipalUser: varPrincipalUserUserid
  DetectionTime: detectionTime
  TargetHostname: varTargetHostname
  PrincipalHostname: varPrincipalHostname
queryFrequency: 10m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleSecOps/Analytic%20Rules/GoogleSecOps-DetectionAlerts.yaml
triggerThreshold: 0
description: |
  Creates one incident per active Google Security Operations detection alert in Microsoft Sentinel. Covers all rule types and severity levels with no additional filtering, providing broad visibility across all Google SecOps alerts. Use alongside focused rules for complete detection coverage.
id: f6b0c254-8f7d-4a1b-d5c2-0e4a6b9f2d8a
triggerOperator: gt
alertDetailsOverride:
  alertDescriptionFormat: 'Google SecOps detection alert. Rule: {{ruleName}}. Severity: {{severity}}. Type: {{ruleType}}.'
  alertDisplayNameFormat: 'Google SecOps Alert: {{ruleName}} : {{id}}'
status: Available
relevantTechniques:
- T1078
- T1021
- T1566
version: 1.0.0
name: Google SecOps - Detection Alerts
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: varPrincipalIp
    identifier: Address
- entityType: IP
  fieldMappings:
  - columnName: varTargetIp
    identifier: Address
- entityType: IP
  fieldMappings:
  - columnName: varSourceIp
    identifier: Address
- entityType: IP
  fieldMappings:
  - columnName: varCorrelationIp
    identifier: Address
- entityType: URL
  fieldMappings:
  - columnName: urlBackToProduct
    identifier: Url
query: |
  GoogleSecOpsDetectionAlerts
  | where alertState == "ALERTING"

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f6b0c254-8f7d-4a1b-d5c2-0e4a6b9f2d8a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f6b0c254-8f7d-4a1b-d5c2-0e4a6b9f2d8a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Google SecOps detection alert. Rule: {{ruleName}}. Severity: {{severity}}. Type: {{ruleType}}.",
          "alertDisplayNameFormat": "Google SecOps Alert: {{ruleName}} : {{id}}"
        },
        "alertRuleTemplateName": "f6b0c254-8f7d-4a1b-d5c2-0e4a6b9f2d8a",
        "customDetails": {
          "alert_identifier": "id",
          "AlertState": "alertState",
          "CorrelationIP": "varCorrelationIp",
          "DetectionTime": "detectionTime",
          "DetectionType": "detectionType",
          "PrincipalHostname": "varPrincipalHostname",
          "PrincipalIP": "varPrincipalIp",
          "PrincipalUser": "varPrincipalUserUserid",
          "RiskScore": "riskScore",
          "RuleId": "ruleId",
          "RuleName": "ruleName",
          "RuleType": "ruleType",
          "Severity": "severity",
          "SourceHostname": "varSourceHostname",
          "SourceIP": "varSourceIp",
          "SourceUser": "varSourceUserUserid",
          "TargetHostname": "varTargetHostname",
          "TargetIP": "varTargetIp",
          "TargetUser": "varTargetUserUserid"
        },
        "description": "Creates one incident per active Google Security Operations detection alert in Microsoft Sentinel. Covers all rule types and severity levels with no additional filtering, providing broad visibility across all Google SecOps alerts. Use alongside focused rules for complete detection coverage.\n",
        "displayName": "Google SecOps - Detection Alerts",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "varPrincipalIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "varTargetIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "varSourceIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "varCorrelationIp",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "urlBackToProduct",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "alert_identifier"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleSecOps/Analytic%20Rules/GoogleSecOps-DetectionAlerts.yaml",
        "query": "GoogleSecOpsDetectionAlerts\n| where alertState == \"ALERTING\"\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "DefenseEvasion",
          "InitialAccess",
          "LateralMovement",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1021",
          "T1078",
          "T1566"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}