XbowCriticalHighFindings

XbowFindings_CL
| where TimeGenerated > ago(1h)
| where tolower(Severity) in ('critical', 'high')
| where isempty(State) or tolower(State) == 'open'
| summarize arg_max(TimeGenerated, *) by FindingId
| join kind=leftouter (
    XbowAssets_CL
    | summarize arg_max(TimeGenerated, *) by AssetId
    | project AssetId, StartUrl
) on AssetId
| project
    TimeGenerated,
    FindingId,
    FindingName,
    Severity,
    State,
    Summary,
    Impact,
    Mitigations,
    Recipe,
    AssetId,
    AssetName,
    OrganizationId,
    CreatedAt,
    StartUrl

incidentConfiguration:
  groupingConfiguration:
    groupByCustomDetails:
    - FindingID
    lookbackDuration: 24h
    enabled: true
    reopenClosedIncident: false
    matchingMethod: Selected
  createIncident: true
name: XbowCriticalHighFindings
triggerOperator: gt
query: |
  XbowFindings_CL
  | where TimeGenerated > ago(1h)
  | where tolower(Severity) in ('critical', 'high')
  | where isempty(State) or tolower(State) == 'open'
  | summarize arg_max(TimeGenerated, *) by FindingId
  | join kind=leftouter (
      XbowAssets_CL
      | summarize arg_max(TimeGenerated, *) by AssetId
      | project AssetId, StartUrl
  ) on AssetId
  | project
      TimeGenerated,
      FindingId,
      FindingName,
      Severity,
      State,
      Summary,
      Impact,
      Mitigations,
      Recipe,
      AssetId,
      AssetName,
      OrganizationId,
      CreatedAt,
      StartUrl
queryFrequency: 30m
description: |
  Creates an incident for each Critical or High severity finding reported by XBOW that
  is currently in an open state. These findings represent the most severe security issues
  and require immediate attention. Each alert is deduplicated per finding so re-ingestion
  of the same finding does not produce duplicate incidents.
id: f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678
triggerThreshold: 0
queryPeriod: 1h
version: 1.0.1
kind: Scheduled
customDetails:
  AssetID: AssetId
  CreatedAt: CreatedAt
  Mitigations: Mitigations
  Severity: Severity
  FindingName: FindingName
  FindingID: FindingId
  AssetName: AssetName
  OrganizationID: OrganizationId
  State: State
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: XbowSecurityConnector
  dataTypes:
  - XbowFindings_CL
  - XbowAssets_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowCriticalHighFindings.yaml
alertDetailsOverride:
  alertDescriptionFormat: '{{Severity}} severity finding on {{AssetName}}. {{Summary}}'
  alertDisplayNameFormat: 'XBOW {{Severity}}: {{FindingName}}'
relevantTechniques:
- T1190
tactics:
- InitialAccess
- Execution
- PrivilegeEscalation
- DefenseEvasion
- Impact
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: StartUrl
  entityType: URL

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{Severity}} severity finding on {{AssetName}}. {{Summary}}",
          "alertDisplayNameFormat": "XBOW {{Severity}}: {{FindingName}}"
        },
        "alertRuleTemplateName": "f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678",
        "customDetails": {
          "AssetID": "AssetId",
          "AssetName": "AssetName",
          "CreatedAt": "CreatedAt",
          "FindingID": "FindingId",
          "FindingName": "FindingName",
          "Mitigations": "Mitigations",
          "OrganizationID": "OrganizationId",
          "Severity": "Severity",
          "State": "State"
        },
        "description": "Creates an incident for each Critical or High severity finding reported by XBOW that\nis currently in an open state. These findings represent the most severe security issues\nand require immediate attention. Each alert is deduplicated per finding so re-ingestion\nof the same finding does not produce duplicate incidents.\n",
        "displayName": "XbowCriticalHighFindings",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "StartUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "FindingID"
            ],
            "lookbackDuration": "PT24H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowCriticalHighFindings.yaml",
        "query": "XbowFindings_CL\n| where TimeGenerated > ago(1h)\n| where tolower(Severity) in ('critical', 'high')\n| where isempty(State) or tolower(State) == 'open'\n| summarize arg_max(TimeGenerated, *) by FindingId\n| join kind=leftouter (\n    XbowAssets_CL\n    | summarize arg_max(TimeGenerated, *) by AssetId\n    | project AssetId, StartUrl\n) on AssetId\n| project\n    TimeGenerated,\n    FindingId,\n    FindingName,\n    Severity,\n    State,\n    Summary,\n    Impact,\n    Mitigations,\n    Recipe,\n    AssetId,\n    AssetName,\n    OrganizationId,\n    CreatedAt,\n    StartUrl\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution",
          "Impact",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}