Darktrace AI Analyst

Back


Id	ffa2977f-3077-4bba-b1bf-f3417699cbb0
Rulename	Darktrace AI Analyst
Description	This rule creates Microsoft Sentinel Incidents based on Darktrace AI Analyst Incidents, fetched every 5 minutes.
Severity	High
Required data connectors	DarktraceRESTConnector
Kind	NRT
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Darktrace/Analytic Rules/CreateIncidentFromAIAnalystIncident.yaml
Version	1.0.0
Arm template	ffa2977f-3077-4bba-b1bf-f3417699cbb0.json

KQL

darktrace_model_alerts_CL
| where dtProduct_s == "AI Analyst"
| project-rename  EventStartTime=startTime_s
| project-rename EventEndTime = endTime_s
| project-rename NetworkRuleName=title_s
| project-rename CurrentGroup=externalId_g //externalId is the Current Group ID from Darktrace 
| project-rename ThreatCategory=dtProduct_s
| extend ThreatRiskLevel=score_d //This is the event score, which is different from the GroupScore
| project-rename SrcHostname=hostname_s
| project-rename DarktraceLink=url_s
| project-rename Summary=summary_s
| project-rename GroupScore=groupScore_d
| project-rename GroupCategory=groupCategory_s
| project-rename SrcDeviceName=bestDeviceName_s

YAML

name: Darktrace AI Analyst
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  darktrace_model_alerts_CL
  | where dtProduct_s == "AI Analyst"
  | project-rename  EventStartTime=startTime_s
  | project-rename EventEndTime = endTime_s
  | project-rename NetworkRuleName=title_s
  | project-rename CurrentGroup=externalId_g //externalId is the Current Group ID from Darktrace 
  | project-rename ThreatCategory=dtProduct_s
  | extend ThreatRiskLevel=score_d //This is the event score, which is different from the GroupScore
  | project-rename SrcHostname=hostname_s
  | project-rename DarktraceLink=url_s
  | project-rename Summary=summary_s
  | project-rename GroupScore=groupScore_d
  | project-rename GroupCategory=groupCategory_s
  | project-rename SrcDeviceName=bestDeviceName_s  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Darktrace/Analytic Rules/CreateIncidentFromAIAnalystIncident.yaml
queryFrequency: 5m
triggerThreshold: 0
requiredDataConnectors:
- dataTypes:
  - darktrace_model_alerts_CL
  connectorId: DarktraceRESTConnector
version: 1.0.0
queryPeriod: 5m
id: ffa2977f-3077-4bba-b1bf-f3417699cbb0
triggerOperator: gt
entityMappings:
- fieldMappings:
  - identifier: HostName
    columnName: SrcDeviceName
  entityType: Host
customDetails:
  GroupScore: GroupScore
  CurrentGroupID: CurrentGroup
  DarktraceLink: DarktraceLink
  IncidentSummary: Summary
  EventEndTime: EventEndTime
  SrcDeviceName: SrcDeviceName
  GroupCategory: GroupCategory
  EventScore: ThreatRiskLevel
  Title: NetworkRuleName
  EventStartTime: EventStartTime
relevantTechniques: []
alertDetailsOverride:
  alertSeverityColumnName: 
  alertDescriptionFormat: '{{Summary}}'
  alertDisplayNameFormat: '{{NetworkRuleName}}'
  alertTacticsColumnName: 
severity: High
description: |
    'This rule creates Microsoft Sentinel Incidents based on Darktrace AI Analyst Incidents, fetched every 5 minutes.'
kind: NRT
tactics: []

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/ffa2977f-3077-4bba-b1bf-f3417699cbb0')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/ffa2977f-3077-4bba-b1bf-f3417699cbb0')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Nrt",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Darktrace AI Analyst",
        "description": "'This rule creates Microsoft Sentinel Incidents based on Darktrace AI Analyst Incidents, fetched every 5 minutes.'\n",
        "severity": "High",
        "enabled": true,
        "query": "darktrace_model_alerts_CL\n| where dtProduct_s == \"AI Analyst\"\n| project-rename  EventStartTime=startTime_s\n| project-rename EventEndTime = endTime_s\n| project-rename NetworkRuleName=title_s\n| project-rename CurrentGroup=externalId_g //externalId is the Current Group ID from Darktrace \n| project-rename ThreatCategory=dtProduct_s\n| extend ThreatRiskLevel=score_d //This is the event score, which is different from the GroupScore\n| project-rename SrcHostname=hostname_s\n| project-rename DarktraceLink=url_s\n| project-rename Summary=summary_s\n| project-rename GroupScore=groupScore_d\n| project-rename GroupCategory=groupCategory_s\n| project-rename SrcDeviceName=bestDeviceName_s\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "alertRuleTemplateName": "ffa2977f-3077-4bba-b1bf-f3417699cbb0",
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "alertDetailsOverride": {
          "alertSeverityColumnName": null,
          "alertDescriptionFormat": "{{Summary}}",
          "alertDisplayNameFormat": "{{NetworkRuleName}}",
          "alertTacticsColumnName": null
        },
        "customDetails": {
          "Title": "NetworkRuleName",
          "GroupScore": "GroupScore",
          "DarktraceLink": "DarktraceLink",
          "IncidentSummary": "Summary",
          "EventEndTime": "EventEndTime",
          "SrcDeviceName": "SrcDeviceName",
          "EventStartTime": "EventStartTime",
          "GroupCategory": "GroupCategory",
          "CurrentGroupID": "CurrentGroup",
          "EventScore": "ThreatRiskLevel"
        },
        "entityMappings": [
          {
            "fieldMappings": [
              {
                "identifier": "HostName",
                "columnName": "SrcDeviceName"
              }
            ],
            "entityType": "Host"
          }
        ],
        "templateVersion": "1.0.0",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Darktrace/Analytic Rules/CreateIncidentFromAIAnalystIncident.yaml"
      }
    }
  ]
}