detection.wiki

Detection rules › Kusto

Anvilogic Alert

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status
available
Severity
medium
Time window
5m
Source
github.com/Azure/Azure-Sentinel

'Alert generated by Anvilogic.'

Rule body kusto

id: 6ccc187a-42ee-4635-8bcc-3b299f8570df
name: Anvilogic Alert
description: |
  'Alert generated by Anvilogic.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Anvilogic
    dataTypes:
      - Anvilogic_Alerts_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 1h
suppressionEnabled: false
tactics: []
relevantTechniques: []
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5M
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: "{{avl_rule_id}} - {{avl_use_case_title}} - {{avl_use_case_type}}"
  alertDescriptionFormat: "avl_rule_id: {{avl_rule_id}} \n{{avl_definition}}"
  "alertTacticsColumnName": "avl_mitre_tactic"
  alertDynamicProperties: 
    - alertProperty: Techniques
      value: avl_mitre_technique
customDetails:
  raw: raw
  tactics: avl_mitre_tactic
  techniques: avl_mitre_technique
query: |
  Anvilogic_Alerts_CL | where avl_rule_mode!='Warn'
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: coi_account
      - identifier: NTDomain
        columnName: src_nt_domain
      - identifier: Sid
        columnName: ssid
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: coi_host
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: coi_ip
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: url
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: coi_app
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: file_name
      - identifier: Directory
        columnName: file_path
  - entityType: Process
    fieldMappings:
      - identifier: ProcessId
        columnName: process_id
      - identifier: CommandLine
        columnName: process_exec
  - entityType: RegistryKey
    fieldMappings:
      - identifier: Hive
        columnName: registry_hive
      - identifier: Key
        columnName: registry_key_name
  - entityType: RegistryValue
    fieldMappings:
      - identifier: Name
        columnName: registry_value_name
      - identifier: Value
        columnName: registry_value_data
      - identifier: ValueType
        columnName: registry_value_type
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: source

Anvilogic_Alerts_CL

Stage 2: where

| where avl_rule_mode!='Warn'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
avl_rule_modene
  • Warn transforms: cased