Digital Shadows Incident Creation for exclude-app

Back


Id	f7abe9c1-1e6c-4317-b907-25769e7764c5
Rulename	Digital Shadows Incident Creation for exclude-app
Description	Digital Shadows Analytic rule for generating Microsoft Sentinel incidents for the data ingested by app polling for excluded classifications
Severity	Medium
Required data connectors	DigitalShadows
Kind	Scheduled
Query frequency	5m
Query period	6m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Shadows/Analytic Rules/Digital_Shadows_incident_creation_exclude.yaml
Version	1.0.2
Arm template	f7abe9c1-1e6c-4317-b907-25769e7764c5.json

KQL

let DSSearchLight_view  = view () { DigitalShadows_CL | where app_s == "exclude" | extend EventVendor="Digital Shadows", EventProduct="SearchLight",Type="DigitalShadows_CL",EventStartTime=raised_t,EventMessage=title_s,EventOriginalUid=triage_id_g,EventOriginalType=classification_s | extend EventOriginalSeverity=iif(isempty(risk_level_s), risk_assessment_risk_level_s, risk_level_s) | extend EventSeverity = case(EventOriginalSeverity == 'none', 'Informational', EventOriginalSeverity == 'very-low', 'Low',EventOriginalSeverity == 'low', 'Low',EventOriginalSeverity == 'medium', 'Medium',EventOriginalSeverity == 'high', 'High',EventOriginalSeverity == 'very-high', 'High','Informational') | extend EventReportUrl=iif(isempty(id_d), strcat('https://portal-digitalshadows.com/triage/alerts/',portal_id_s),strcat('https://portal-digitalshadows.com/triage/alert-incidents/',id_d)) | extend AdditionalFields = pack("assets", assets_s, "comments", comments_s, "description", description_s, "incident_id", id_d, "alert_id", id_g, "short_code", portal_id_s, "impact", impact_description_s, "mitigation", mitigation_s, "risk_factors", risk_factors_s, "triage_status", status_s, "triage_id", triage_id_g, "triage_raised", triage_raised_time_t,"triage_updated", triage_updated_time_t, "updated", updated_t) | project TimeGenerated, EventVendor,EventProduct, Type, EventStartTime,EventMessage, EventOriginalUid, EventOriginalType,EventOriginalSeverity, EventSeverity, EventReportUrl,AdditionalFields};DSSearchLight_view | summarize arg_max(TimeGenerated, *) by EventOriginalUid | extend description = AdditionalFields.description | extend impact = AdditionalFields.impact | extend mitigation = AdditionalFields.mitigation | extend status = AdditionalFields.triage_status | extend comments = AdditionalFields.comments

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Digital Shadows/Analytic Rules/Digital_Shadows_incident_creation_exclude.yaml
queryPeriod: 6m
description: Digital Shadows Analytic rule for generating Microsoft Sentinel incidents for the data ingested by app polling for excluded classifications
alertRuleTemplateName: 
triggerThreshold: 0
name: Digital Shadows Incident Creation for exclude-app
triggerOperator: gt
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: EventReportUrl
kind: Scheduled
requiredDataConnectors:
- connectorId: DigitalShadows
  dataTypes:
  - DigitalShadows_CL
enabled: true
customDetails:
  triage_id: EventOriginalUid
  mitigation: mitigation
  impact: impact
  description: description
  status: status
  severity: EventOriginalSeverity
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionDuration: 5h
queryFrequency: 5m
suppressionEnabled: false
tactics: []
id: f7abe9c1-1e6c-4317-b907-25769e7764c5
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: 7d
    matchingMethod: Selected
    enabled: true
    groupByCustomDetails:
    - triage_id
    groupByEntities: []
    reopenClosedIncident: true
    groupByAlertDetails: []
techniques: []
version: 1.0.2
query: let DSSearchLight_view  = view () { DigitalShadows_CL | where app_s == "exclude" | extend EventVendor="Digital Shadows", EventProduct="SearchLight",Type="DigitalShadows_CL",EventStartTime=raised_t,EventMessage=title_s,EventOriginalUid=triage_id_g,EventOriginalType=classification_s | extend EventOriginalSeverity=iif(isempty(risk_level_s), risk_assessment_risk_level_s, risk_level_s) | extend EventSeverity = case(EventOriginalSeverity == 'none', 'Informational', EventOriginalSeverity == 'very-low', 'Low',EventOriginalSeverity == 'low', 'Low',EventOriginalSeverity == 'medium', 'Medium',EventOriginalSeverity == 'high', 'High',EventOriginalSeverity == 'very-high', 'High','Informational') | extend EventReportUrl=iif(isempty(id_d), strcat('https://portal-digitalshadows.com/triage/alerts/',portal_id_s),strcat('https://portal-digitalshadows.com/triage/alert-incidents/',id_d)) | extend AdditionalFields = pack("assets", assets_s, "comments", comments_s, "description", description_s, "incident_id", id_d, "alert_id", id_g, "short_code", portal_id_s, "impact", impact_description_s, "mitigation", mitigation_s, "risk_factors", risk_factors_s, "triage_status", status_s, "triage_id", triage_id_g, "triage_raised", triage_raised_time_t,"triage_updated", triage_updated_time_t, "updated", updated_t) | project TimeGenerated, EventVendor,EventProduct, Type, EventStartTime,EventMessage, EventOriginalUid, EventOriginalType,EventOriginalSeverity, EventSeverity, EventReportUrl,AdditionalFields};DSSearchLight_view | summarize arg_max(TimeGenerated, *) by EventOriginalUid | extend description = AdditionalFields.description | extend impact = AdditionalFields.impact | extend mitigation = AdditionalFields.mitigation | extend status = AdditionalFields.triage_status | extend comments = AdditionalFields.comments
alertDetailsOverride:
  alertDescriptionFormat: |-
    {{description}}

    {{impact}}

    {{mitigation}}    
  alertTacticsColumnName: 
  alertDisplayNameFormat: Digital Shadows - {{EventMessage}}
  alertSeverityColumnName: EventSeverity
severity: Medium
relevantTechniques: []

ARM