Kusto rules: 35

id: dfa3ec92-bdae-410f-b675-fe1814e4d43e
name: Awake Security - Model With Multiple Destinations
description: This query searches for devices with multiple possibly malicious destinations.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  CommonSecurityLog | where DeviceVendor == "Arista Networks" and DeviceProduct == "Awake Security"
  | summarize StartTime=min(TimeGenerated), EndTime=max(TimeGenerated), Models=make_set(Activity), ASPMatchURLs=make_set(DeviceCustomString2), SourceIPs=make_set(SourceIP),
    DestinationIPs=make_set(DestinationIP), ModelMatchCount=sum(EventCount), MaxSeverity=max(toint(LogSeverity)) by SourceHostName
  | where array_length(DestinationIPs) > 1
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: Awake Security - Model Matches With Multiple Destinations On Device {{SourceHostName}}
  alertDescriptionFormat: |
    Device {{SourceHostName}} communicated with multiple possibly malicious destinations.  The destination IPs were:

    {{DestinationIPs}}

    The associated with Awake model(s) were:

    {{Models}}
  alertTacticsColumnName: null
  alertSeverityColumnName: null
customDetails:
  Matched_Models: Models
  Matches_ASP_URLs: ASPMatchURLs
  Device: SourceHostName
  Matches_Count: ModelMatchCount
  Matches_Max_Severity: MaxSeverity
  Matches_Dest_IPs: DestinationIPs
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: SourceHostName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIPs
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: true
    lookbackDuration: 3d
    matchingMethod: Selected
    groupByEntities:
      - Host
    groupByAlertDetails: []
    groupByCustomDetails:
      - Device
version: 1.0.2
kind: Scheduled

id: 3b803560-f8a6-4db4-89cb-617d89724ba1
name: Box - Item shared to external entity
description: |
  'Detects when an item was shared to external entity.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BoxDataConnector
    dataTypes:
      - BoxEvents_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1537
query: |
  BoxEvents
  | where EventType =~ 'COLLABORATION_INVITE'
  | extend corp_domain = tolower(extract(@'@(.*)', 1, SrcUserUpn))
  | extend accessibleby_domain = tolower(extract(@'@(.*)', 1, AccessibleByLogin))
  | where corp_domain != accessibleby_domain
  | extend AccountCustomEntity = SrcUserUpn
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

id: 1b212329-6f2c-46ca-9071-de3464f3d88d
name: Box - Many items deleted by user
description: |
  'Detects when a user deletes many items in short period of time.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: BoxDataConnector
    dataTypes:
      - BoxEvents_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1485
query: |
  let threshold = 100;
  BoxEvents
  | where EventType =~ 'DELETE'
  | summarize deleted_items = dcount(SourceItemName) by SrcUserName, bin(EventEndTime, 5m)
  | where deleted_items > threshold
  | extend AccountCustomEntity = SrcUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.1
kind: Scheduled

id: 5b72f527-e3f6-4a00-9908-8e4fee14da9f
name: CloudNGFW By Palo Alto Networks - possible internal to external port scanning
description: |
  'Identifies a list of internal Source IPs (10.x.x.x Hosts) that have triggered 10 or more non-graceful tcp server resets from one or more Destination IPs which results in an "app = incomplete" designation. The server resets coupled with an "Incomplete" app designation can be an indication of internal to external port scanning or probing attack.
  References: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUvCAK
  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTaCAK'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: AzureCloudNGFWByPaloAltoNetworks
    dataTypes:
      - fluentbit_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
relevantTechniques:
  - T1046
query: |
  fluentbit_CL
  | where ident_s == "TRAFFIC"
  | where isnotempty(FirewallName_s)
  | extend message = parse_json(Message)
  | extend DestinationPort = tostring(message.dport)
  | extend SourceIP = tostring(message.src_ip)
  | extend DestinationIP = tostring(message.dst_ip)
  | extend Application = tostring(message.app)
  | extend Protocol = tostring(message.proto)
  | extend Action = tostring(message.action)
  | where isnotempty(DestinationPort) and message.action !in ("reset-both", "deny")
  | where DestinationPort !in ("443", "53", "389", "80", "0", "880", "8888", "8080")
  | where message.app == "incomplete"
  | where toint(DestinationPort) !between (49512 .. 65535)
  | where message.dst_ip !startswith "10."
  | extend Reason = coalesce(column_ifexists("Reason", ""), tostring(message.session_end_reason), "")
  | where Reason !has "aged-out"
  | where Reason !has "tcp-fin"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by FirewallName_s, SourceIP, Application, Reason, DestinationPort, Protocol, ident_s, Action, DestinationIP
  | where count_ >= 10
  | summarize StartTime = min(StartTime), EndTime = max(EndTime), makeset(DestinationIP), totalcount = sum(count_) by FirewallName_s, SourceIP, Application, Reason, DestinationPort, Protocol, ident_s, Action
  | extend IPAddress = SourceIP
  | extend HostName = tostring(split(FirewallName_s, ".")[0]), DomainIndex = toint(indexof(FirewallName_s, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(FirewallName_s, DomainIndex + 1), FirewallName_s)
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: FirewallName_s
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
version: 1.0.6
kind: Scheduled

id: 276d5190-38de-4eb2-9933-b3b72f4a5737
name: Cross-tenant Access Settings Organization Inbound Direct Settings Changed
description: |
  'Organizations are added in the Cross-tenant Access Settings to control communication inbound or outbound for users and applications. This detection notifies when Organization Inbound Direct Settings are changed for "Users & Groups" and for "Applications".'
severity: Medium
requiredDataConnectors:
  - connectorId: AzureActiveDirectory
    dataTypes:
      - AuditLogs
queryFrequency: 2d
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
status: Available
tactics:
  - InitialAccess
  - Persistence
  - Discovery
relevantTechniques:
  - T1078.004
  - T1136.003
  - T1087.004
query: |
  // In User & Groups and in Applications, the following "AccessType" values in columns PremodifiedInboundSettings and ModifiedInboundSettings are interpreted accordingly
  // When Access Type in premodified inbound settings value was 1 that means that the initial access was allowed. When Access Type in premodified inbound settings value was 2 that means that the initial access was blocked.
  // When Access Type in modified inbound settings value is 1 that means that now access is allowed. When Access Type in modified inbound settings value is 2 that means that now access is blocked.
  AuditLogs
  | where OperationName has "Update a partner cross-tenant access setting"
  | mv-apply TargetResource = TargetResources on
    (
        where TargetResource.type =~ "Policy"
        | extend Properties = TargetResource.modifiedProperties
    )
  | mv-apply Property = Properties on
    (
        where Property.displayName =~ "b2bDirectConnectInbound"
        | extend PremodifiedInboundSettings = trim('"',tostring(Property.oldValue)),
                 ModifiedInboundSettings = trim(@'"',tostring(Property.newValue))
    )
  | where PremodifiedInboundSettings != ModifiedInboundSettings
  | extend InitiatingAppName = tostring(InitiatedBy.app.displayName)
  | extend InitiatingAppServicePrincipalId = tostring(InitiatedBy.app.servicePrincipalId)
  | extend InitiatingUserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)
  | extend InitiatingAadUserId = tostring(InitiatedBy.user.id)
  | extend InitiatingIpAddress = tostring(iff(isnotempty(InitiatedBy.user.ipAddress), InitiatedBy.user.ipAddress, InitiatedBy.app.ipAddress))
  | extend InitiatingAccountName = tostring(split(InitiatingUserPrincipalName, "@")[0]), InitiatingAccountUPNSuffix = tostring(split(InitiatingUserPrincipalName, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: InitiatingAppName
      - identifier: AadUserId
        columnName: InitiatingAppServicePrincipalId
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: InitiatingUserPrincipalName
      - identifier: Name
        columnName: InitiatingAccountName
      - identifier: UPNSuffix
        columnName: InitiatingAccountUPNSuffix
  - entityType: Account
    fieldMappings:
      - identifier: AadUserId
        columnName: InitiatingAadUserId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: InitiatingIpAddress
version: 1.1.1
kind: Scheduled

id: c1ebc79d-7f46-429e-bf2c-8bb0b75ba6b2
name: Cyble Vision Alerts OT/ICS Threat Activity Detected
description: |
  'This alert indicates detection of OT/ICS-related network activity involving industrial control protocols (e.g., IEC104). May indicate probing, reconnaissance, or attempted access against critical infrastructure assets.'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
enabled: true
queryfrequency: 30m
queryPeriod: 30m
triggerOperator: GreaterThan
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- Discovery
- Collection
relevantTechniques:
- T0842
- T0830
query: |
  Alerts_ot_ics  
  | where Service == "ot_ics" 
  | extend MappedSeverity = Severity
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
  alertDetailsOverride:
  alertDisplayNameFormat: OT/ICS Activity Detected from {{OT_SourceIP}}
  description: |
    Cyble detected industrial control system related traffic involving protocol {{OT_DataType}} from IP {{OT_SourceIP}}. Destination port {{OT_DestPort}}. Country. {{OT_Country}}. This may indicate reconnaissance or hostile probing of OT/ICS infrastructure.
customDetails:
  MappedSeverity: Severity
  Status: Status
  AlertID: AlertID
  Service: Service
  OT_ASN: OT_ASN
  OT_Country: OT_Country
  OT_SourceIP: OT_SourceIP
  OT_DataType: OT_DataType
  OT_DestPort: OT_DestPort
  OT_IP_Reputation: OT_IP_Reputation
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: OT_SourceIP
version: 1.0.0
kind: Scheduled

id: 52c2f8d4-1dc8-4141-9152-614c036390a0
name: CYFIRMA - Medium severity Malicious Network Indicators with Monitor Action Rule
description:  |
  "This rule detects Network indicators such as IP addresses, domains, and URLs reported by CYFIRMA threat intelligence with a recommended action of 'Monitor' and no specified role. 
  These indicators may be associated with infrastructure used in phishing campaigns, malware, or initial access via watering hole or drive-by compromise techniques."
version: 1.0.1
kind: Scheduled
severity: Medium
enabled: false
requiredDataConnectors:
  - connectorId: CyfirmaCyberIntelligenceDC
    dataTypes:
      - CyfirmaIndicators_CL
query: |
  //Network Indicators with Monitor Action 
  let timeFrame= 5m;
  CyfirmaIndicators_CL 
  | where  (ConfidenceScore < 80 and ConfidenceScore >= 50)
      and TimeGenerated between (ago(timeFrame) .. now())
      and pattern !contains 'file:hashes' and RecommendedActions has 'Monitor' and (isempty(Roles) or not(Roles has_any ('Command & Control', 'Malware', 'TOR', 'Trojan', 'Phishing')))
  | extend IPv4 = extract(@"ipv4-addr:value\s*=\s*'([^']+)'", 1, pattern)
  | extend IPv6 = extract(@"ipv6-addr:value\s*=\s*'([^']+)'", 1, pattern)
  | extend URL = extract(@"url:value\s*=\s*'([^']+)'", 1, pattern)
  | extend Domain = extract(@"domain-name:value\s*=\s*'([^']+)'", 1, pattern)
  | extend parsed = parse_json(extensions)
  | extend extensionKeys = bag_keys(parsed)
  | mv-expand extensionKeys
  | extend extensionKeyStr = tostring(extensionKeys)
  | extend ext = parsed[extensionKeyStr]
  | extend props = ext.properties
  | extend 
      extension_id = extensionKeyStr,
      ASN_Owner = props.asn_owner,
      ASN = props.asn,
      ProviderName = 'CYFIRMA',
      ProductName = 'DeCYFIR/DeTCT'
  | project
      IPv4,
      IPv6,
      URL,
      Domain,
      ThreatActors,
      RecommendedActions,
      Sources,
      Roles,
      Country,
      IPAbuse,
      name,
      Description,
      ConfidenceScore,
      IndicatorID,
      created,
      modified,
      valid_from,
      Tags,
      ThreatType,
      TimeGenerated,
      SecurityVendors,
      ProductName,
      ProviderName
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: GreaterThan
triggerThreshold: 0
suppressionDuration: 5m
suppressionEnabled: true
tactics:
  - InitialAccess
  - Execution
  - Reconnaissance
  - Impact
relevantTechniques:
  - T1566
  - T1189
  - T1204
  - T1595
  - T1498
  - T1566.002
  - T1204.001
  - T1595.002
alertDetailsOverride:
  alertDisplayNameFormat: "High-Confidence Malicious Network Indicators with Monitor Action Rule - {{name}} "
  alertDescriptionFormat: "{{Description}} - {{name}} "
  alertDynamicProperties:
    - alertProperty: ProductName
      value: ProductName
    - alertProperty: ProviderName
      value: ProviderName
customDetails:
  ThreatActors: ThreatActors
  Sources: Sources
  RecommendedActions: RecommendedActions
  Roles: Roles
  Country: Country
  Description: Description
  ConfidenceScore: ConfidenceScore
  SecurityVendors: SecurityVendors
  IndicatorID: IndicatorID
  Created: created
  Modified: modified
  ValidFrom: valid_from
  Tags: Tags
  ThreatType: ThreatType
  TimeGenerated: TimeGenerated
  IPAbuse: IPAbuse
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPv4
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPv6
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: Domain
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: URL
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult

id: 211e9f49-3fca-4598-bc6e-e2c28d86e72c
name: Cynerio - Medical device scanning
description: Medical device is scanned with vulnerability scanner
severity: Medium
requiredDataConnectors:
  - connectorId: CynerioSecurityEvents
    dataTypes:
      - CynerioEvent_CL
queryFrequency: 5h
queryPeriod: 5h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T0866
query: |
  CynerioEvent_CL
  | where TimeGenerated > ago(24h)
  | where module_s == 'IDS'
  | where title_s == 'Scanner Activity'
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: asset_ip_s
eventGroupingSettings:
  aggregationKind: SingleAlert
customDetails: 
  DeviceType: asset_type_s
version: 1.0.0
kind: Scheduled

id: 716cf6d4-97ad-407b-923e-6790083acb58
kind: Scheduled
name: Dataverse - Mass deletion of records
description: Identifies large scale record delete operations based on a predefined
  threshold and also detects scheduled bulk deletion jobs.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Dataverse
    dataTypes:
      - DataverseActivity
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1485
query: |
  let mass_delete_threshold = 10000;
  let query_frequency = 1d;
  let delete_activities = DataverseActivity
      | where TimeGenerated >= ago(query_frequency)
      | where Message == "Delete";
  union
      (
      delete_activities
      | summarize FirstEvent = min(TimeGenerated), TotalEvents = count() by UserId, InstanceUrl
      | where TotalEvents > mass_delete_threshold
      | join kind=inner (
          delete_activities
          | summarize DeleteCount = count() by UserId, InstanceUrl, ClientIp, EntityName)
          on UserId, InstanceUrl
      | extend Entities = bag_pack("Entity", EntityName, "Count", DeleteCount)
      | summarize Details = make_set(Entities, 100), FirstEvent = min(FirstEvent) by UserId, InstanceUrl, ClientIp, TotalEvents
      ),
      (
      DataverseActivity
      | where TimeGenerated >= ago(query_frequency)
      | where Message == "BulkDelete"
      | summarize FirstEvent = min(TimeGenerated), TotalEvents = count() by UserId, InstanceUrl, ClientIp
      | extend Details = todynamic("Bulk delete scheduled")
      )
  | extend
      CloudAppId = int(32780),
      AccountName = tostring(split(UserId, '@')[0]),
      UPNSuffix = tostring(split(UserId, '@')[1])
  | project
      FirstEvent,
      UserId,
      ClientIp,
      TotalEvents,
      Details,
      InstanceUrl,
      CloudAppId,
      AccountName,
      UPNSuffix
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: UPNSuffix
  - entityType: CloudApplication
    fieldMappings:
      - identifier: AppId
        columnName: CloudAppId
      - identifier: InstanceName
        columnName: InstanceUrl
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIp
alertDetailsOverride:
  alertDisplayNameFormat: 'Dataverse - mass deletion or bulk deletion job detected
    in {{InstanceUrl}} '
  alertDescriptionFormat: '{{UserId}} triggered the mass deletion detection with the
    following information: {{Details}}'
version: 3.2.0

id: 760b8467-e6cc-4006-9149-5696845c1a54
name: Failed sign-ins into LastPass due to MFA
description: |
  'This rule will check if a sign-in failed into LastPass due to MFA.
  An incident can indicate the potential brute forcing of a LastPass account. 
  The use of MFA is identified by combining the sign-in logs, this rule assumes LastPass is federated to Entra ID.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: LastPass
    dataTypes:
      - LastPassNativePoller_CL
  - connectorId: AzureActiveDirectory
    dataTypes:
      - SigninLogs
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
  - InitialAccess
relevantTechniques:
 - T1078
 - T1190
query: |
  LastPassNativePoller_CL
  | where Action_s == "Log in"
  | join (SigninLogs | where AppDisplayName == "LastPass Enterprise") on $left.IP_Address_s == $right.IPAddress and $left.Username_s == $right.UserPrincipalName
  | where ResultType in (50074, 50076)
  | extend AccountCustomEntity = Username_s, IPCustomEntity = IP_Address_s
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.1
kind: Scheduled

id: 9cb7c337-f174-4af6-b0e8-b6b7552d762d
name: Flare google dork results
description: |
    'This query searches for Google dork search results that indicate publicly accessible information about your organization.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Flare
    dataTypes:
      - FireworkV2_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Reconnaissance
relevantTechniques:
  - T1593
query: |
  FireworkV2_CL
  | where notempty(uid) and RiskScore >= 3
  | extend index_name = split(uid, "/")[0]
  | extend category_name = split(uid, "/")[1]
  | where (index_name == "driller_google") or (index_name == "driller" and category_name contains "google")
version: 3.0.0
kind: Scheduled

id: d6b3372a-0fc4-40ec-9630-b96efb527fba
name: Guardian- Security Integrity Checks Prompt Injection Policy Violation Detection
description: |
  'This alert creates an incident when Security Integrity Checks Prompt Injection Policy Violation detected from the Guardian.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: BoschAIShield
    dataTypes:
      - Guardian
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'Prompt Injection / Jailbreaks'
  | where Severity =~ 'High'
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
      - identifier: NTDomain
        columnName: NTDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDisplayNameFormat: Guardian- Security Integrity Checks Prompt Injection Policy Violation detection
  alertDescriptionFormat: |
    This query detects Security Integrity Checks Prompt Injection Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further
  alertSeverityColumnName: Severity
version: 1.0.0
kind: Scheduled

id: ac1a85f1-0e3f-4ae8-9f59-a240fc04b03f
name: Host Settings Updated
description: Detects when host settings are updated in Veeam Backup & Replication.
  This might indicate configuration changes that require review.
severity: Informational
status: Available
requiredDataConnectors:
- connectorId: Syslog
  dataTypes:
  - Syslog
- connectorId: SyslogAma
  dataTypes:
  - Syslog
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics: []
relevantTechniques: []
query: "Veeam_GetSecurityEvents\n| where instanceId == 28400\n| project\n    Date\
  \ = format_datetime(TimeGenerated, 'dd.MM.yyyy HH:mm'),\n    DataSource = original_host,\n\
  \    EventId = instanceId,\n    [\"User Name\"] = user,\n  MessageDetails = Description,\n\
  \   Severity = SeverityDescription"
version: 1.0.1
kind: Scheduled
customDetails:
  Date: Date
  VbrHostName: DataSource
  EventId: EventId
  MessageDetails: MessageDetails
  Severity: Severity

id: c13ecb19-4317-4d87-9a1c-52660dd44a7d
name: Jira - User removed from group
description: |
  'Detects when a user was removed from group.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: JiraAuditAPI
    dataTypes:
      - JiraAudit
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1531
query: |
  JiraAudit
  | where EventMessage =~ 'User removed from group'
  | extend user = todynamic(AssociatedItems)[0]['name']
  | project EventCreationTime, ObjectItemName, user
  | extend AccountCustomEntity = user
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

id: fa566691-42a2-4136-6a8b-ffa3ea510000
name: Lumen TI IPAddress in DeviceEvents
displayName: Lumen TI IPAddress in DeviceEvents
description: |
  This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in DeviceEvents.
severity: Medium
requiredDataConnectors:
  - connectorId: LumenThreatFeedConnector
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: ThreatIntelligenceUploadIndicatorsAPI
    dataTypes:
      - ThreatIntelligenceIndicator
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceEvents
queryFrequency: 4h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: true
tactics:
  - CommandAndControl
relevantTechniques:
  - T1071
query: |
  let dt_lookBack = 1d;  // Data lookback for DeviceEvents
  let ioc_lookBack = 14d; // TI lookback
  let IP_Indicators = ThreatIntelIndicators
    | where TimeGenerated >= ago(ioc_lookBack)
    | where IsActive == true and ValidUntil > now()
    | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by Id
    | where SourceSystem == 'Lumen'
    | where ObservableKey == 'ipv4-addr:value'
    | extend TI_ipEntity = ObservableValue
    | where ipv4_is_private(TI_ipEntity) == false and TI_ipEntity !startswith 'fe80' and TI_ipEntity !startswith '::' and TI_ipEntity !startswith '127.';
  IP_Indicators
  | join kind=innerunique (
      DeviceEvents
      | where TimeGenerated >= ago(dt_lookBack)
      | extend DE_ipEntity = RemoteIP
      | extend DeviceEvents_TimeGenerated = TimeGenerated
    ) on $left.TI_ipEntity == $right.DE_ipEntity
  | where DeviceEvents_TimeGenerated < ValidUntil
  | summarize arg_max(DeviceEvents_TimeGenerated, *), StartTime = min(DeviceEvents_TimeGenerated), EndTime = max(DeviceEvents_TimeGenerated) by Id, DE_ipEntity
  | project timestamp = EndTime, StartTime, EndTime, DeviceName, RemoteIP, ActionType, ReportId, Id, Tags, ValidUntil, Confidence, TI_ipEntity, DE_ipEntity, Type
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: DE_ipEntity
version: 1.0.0
kind: Scheduled

id: 71e6586e-0d3f-4e33-b390-faa50b5e08fa
name: Netskope - Large Outbound Data Transfer / Sensitive Upload (DLP)
description: |
  Detects large outbound data transfers and sensitive file uploads. Monitors for potential data exfiltration via cloud applications.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: NetskopeWebTxConnector
    dataTypes:
      - NetskopeWebTransactions_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1567
  - T1048
query: |
  let uploadThresholdMB = 100;
  NetskopeWebTransactions_CL
  | where TimeGenerated > ago(1h)
  | where isnotempty(CsUsername)
  | where XCsAppActivity =~ 'Upload' or XCsAppActivity =~ 'Post' or XCsAppActivity =~ 'Share' 
      or CsMethod =~ 'POST' or CsMethod =~ 'PUT'
  | where CsBytes > 0 or XRsFileSize > 0
  | extend UploadBytes = coalesce(CsBytes, XRsFileSize, 0)
  | summarize 
      TotalUploadBytes = sum(UploadBytes),
      FileCount = dcount(XCsAppObjectName),
      Files = make_set(XCsAppObjectName, 10),
      FileTypes = make_set(XRsFileType),
      Apps = make_set(XCsApp),
      Destinations = make_set(XCsAppInstanceName),
      Countries = make_set(XSCountry)
      by CsUsername, XCDevice, XCCountry, bin(TimeGenerated, 1h)
  | extend TotalUploadMB = round(TotalUploadBytes / 1048576.0, 2)
  | where TotalUploadMB > uploadThresholdMB
  | extend AlertSeverity = case(
      TotalUploadMB > 1000, 'Critical',
      TotalUploadMB > 500, 'High',
      TotalUploadMB > 100, 'Medium',
      'Low')
  | project 
      TimeGenerated,
      User = CsUsername,
      UploadVolumeMB = TotalUploadMB,
      FileCount,
      Files,
      FileTypes,
      Applications = Apps,
      DestinationInstances = Destinations,
      SourceCountry = XCCountry,
      DestinationCountries = Countries,
      Device = XCDevice,
      AlertSeverity
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: User
version: 1.0.0
kind: Scheduled