XbowCriticalHighFindings

XbowFindings_CL
| where TimeGenerated > ago(1h)
| where tolower(Severity) in ('critical', 'high')
| where isempty(State) or tolower(State) == 'open'
| summarize arg_max(TimeGenerated, *) by FindingId
| join kind=leftouter (
    XbowAssets_CL
    | summarize arg_max(TimeGenerated, *) by AssetId
    | project AssetId, StartUrl
) on AssetId
| project
    TimeGenerated,
    FindingId,
    FindingName,
    Severity,
    State,
    Summary,
    Impact,
    Mitigations,
    Recipe,
    AssetId,
    AssetName,
    OrganizationId,
    CreatedAt,
    StartUrl

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    matchingMethod: Selected
    reopenClosedIncident: false
    lookbackDuration: 24h
    groupByCustomDetails:
    - FindingID
entityMappings:
- entityType: URL
  fieldMappings:
  - columnName: StartUrl
    identifier: Url
query: |
  XbowFindings_CL
  | where TimeGenerated > ago(1h)
  | where tolower(Severity) in ('critical', 'high')
  | where isempty(State) or tolower(State) == 'open'
  | summarize arg_max(TimeGenerated, *) by FindingId
  | join kind=leftouter (
      XbowAssets_CL
      | summarize arg_max(TimeGenerated, *) by AssetId
      | project AssetId, StartUrl
  ) on AssetId
  | project
      TimeGenerated,
      FindingId,
      FindingName,
      Severity,
      State,
      Summary,
      Impact,
      Mitigations,
      Recipe,
      AssetId,
      AssetName,
      OrganizationId,
      CreatedAt,
      StartUrl
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678
queryFrequency: 30m
alertDetailsOverride:
  alertDisplayNameFormat: 'XBOW {{Severity}}: {{FindingName}}'
  alertDescriptionFormat: '{{Severity}} severity finding on {{AssetName}}. {{Summary}}'
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowCriticalHighFindings.yaml
version: 1.0.1
severity: High
relevantTechniques:
- T1190
name: XbowCriticalHighFindings
kind: Scheduled
tactics:
- InitialAccess
- Execution
- PrivilegeEscalation
- DefenseEvasion
- Impact
requiredDataConnectors:
- dataTypes:
  - XbowFindings_CL
  - XbowAssets_CL
  connectorId: XbowSecurityConnector
description: |
  Creates an incident for each Critical or High severity finding reported by XBOW that
  is currently in an open state. These findings represent the most severe security issues
  and require immediate attention. Each alert is deduplicated per finding so re-ingestion
  of the same finding does not produce duplicate incidents.
customDetails:
  AssetName: AssetName
  FindingName: FindingName
  Severity: Severity
  FindingID: FindingId
  State: State
  AssetID: AssetId
  OrganizationID: OrganizationId
  Mitigations: Mitigations
  CreatedAt: CreatedAt
triggerOperator: gt
triggerThreshold: 0
queryPeriod: 1h

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "{{Severity}} severity finding on {{AssetName}}. {{Summary}}",
          "alertDisplayNameFormat": "XBOW {{Severity}}: {{FindingName}}"
        },
        "alertRuleTemplateName": "f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678",
        "customDetails": {
          "AssetID": "AssetId",
          "AssetName": "AssetName",
          "CreatedAt": "CreatedAt",
          "FindingID": "FindingId",
          "FindingName": "FindingName",
          "Mitigations": "Mitigations",
          "OrganizationID": "OrganizationId",
          "Severity": "Severity",
          "State": "State"
        },
        "description": "Creates an incident for each Critical or High severity finding reported by XBOW that\nis currently in an open state. These findings represent the most severe security issues\nand require immediate attention. Each alert is deduplicated per finding so re-ingestion\nof the same finding does not produce duplicate incidents.\n",
        "displayName": "XbowCriticalHighFindings",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "StartUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "FindingID"
            ],
            "lookbackDuration": "PT24H",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/XBOW/Analytic%20Rules/XbowCriticalHighFindings.yaml",
        "query": "XbowFindings_CL\n| where TimeGenerated > ago(1h)\n| where tolower(Severity) in ('critical', 'high')\n| where isempty(State) or tolower(State) == 'open'\n| summarize arg_max(TimeGenerated, *) by FindingId\n| join kind=leftouter (\n    XbowAssets_CL\n    | summarize arg_max(TimeGenerated, *) by AssetId\n    | project AssetId, StartUrl\n) on AssetId\n| project\n    TimeGenerated,\n    FindingId,\n    FindingName,\n    Severity,\n    State,\n    Summary,\n    Impact,\n    Mitigations,\n    Recipe,\n    AssetId,\n    AssetName,\n    OrganizationId,\n    CreatedAt,\n    StartUrl\n",
        "queryFrequency": "PT30M",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution",
          "Impact",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1190"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}