Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Theom - Healthcare data unencrypted

Back
Idfb1b0deb-2a8f-4d8d-8d9d-0a8d327442e7
RulenameTheom - Healthcare data unencrypted
Description“Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0004 (Healthcare data has been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS requirement)”
SeverityHigh
TacticsCollection
TechniquesT1213
T1530
Required data connectorsTheom
KindScheduled
Query frequency5m
Query period5m
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TRIS0004_Healthcare_data_unencrypted.yaml
Version1.0.2
Arm templatefb1b0deb-2a8f-4d8d-8d9d-0a8d327442e7.json
Deploy To Azure
TheomAlerts_CL
  | where customProps_RuleId_s == "TRIS0004" and (priority_s == "P1" or priority_s == "P2")
kind: Scheduled
alertDetailsOverride:
  alertDisplayNameFormat: 'Theom Alert ID: {{id_s}} '
  alertDescriptionFormat: |2

    Summary: {{summary_s}}  
    Additional info: {{details_s}}
    Please investigate further on Theom UI at {{deepLink_s}}
description: |
    "Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0004 (Healthcare data has been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS requirement)"
query: |
  TheomAlerts_CL
    | where customProps_RuleId_s == "TRIS0004" and (priority_s == "P1" or priority_s == "P2")  
eventGroupingSettings:
  aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TRIS0004_Healthcare_data_unencrypted.yaml
entityMappings:
- entityType: CloudApplication
  fieldMappings:
  - columnName: customProps_AssetName_s
    identifier: Name
- entityType: URL
  fieldMappings:
  - columnName: deepLink_s
    identifier: Url
tactics:
- Collection
triggerThreshold: 0
version: 1.0.2
name: Theom - Healthcare data unencrypted
queryPeriod: 5m
requiredDataConnectors:
- dataTypes:
  - TheomAlerts_CL
  connectorId: Theom
triggerOperator: gt
queryFrequency: 5m
status: Available
relevantTechniques:
- T1213
- T1530
severity: High
id: fb1b0deb-2a8f-4d8d-8d9d-0a8d327442e7
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/fb1b0deb-2a8f-4d8d-8d9d-0a8d327442e7')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/fb1b0deb-2a8f-4d8d-8d9d-0a8d327442e7')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "\nSummary: {{summary_s}}  \nAdditional info: {{details_s}}\nPlease investigate further on Theom UI at {{deepLink_s}}\n",
          "alertDisplayNameFormat": "Theom Alert ID: {{id_s}} "
        },
        "alertRuleTemplateName": "fb1b0deb-2a8f-4d8d-8d9d-0a8d327442e7",
        "customDetails": null,
        "description": "\"Creates Sentinel incidents for critical/high Theom risks, associated with ruleId TRIS0004 (Healthcare data has been observed in unencrypted data stores. Encrypt data at rest to comply with this CIS requirement)\"\n",
        "displayName": "Theom - Healthcare data unencrypted",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "CloudApplication",
            "fieldMappings": [
              {
                "columnName": "customProps_AssetName_s",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "deepLink_s",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Theom/Analytic Rules/TRIS0004_Healthcare_data_unencrypted.yaml",
        "query": "TheomAlerts_CL\n  | where customProps_RuleId_s == \"TRIS0004\" and (priority_s == \"P1\" or priority_s == \"P2\")\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection"
        ],
        "techniques": [
          "T1213",
          "T1530"
        ],
        "templateVersion": "1.0.2",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}