Detection rules › Kusto
BitSight - drop in the headline rating
'Rule helps to detect if headline ratings is drop in BitSight.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance | |
| Command & Control |
Rule body
id: b11fdc35-6368-4cc0-8128-52cd2e2cdda0
name: BitSight - drop in the headline rating
description: |
'Rule helps to detect if headline ratings is drop in BitSight.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: BitSight
dataTypes:
- BitSightGraphData
queryFrequency: 1d
queryPeriod: 24h
triggerOperator: GreaterThan
triggerThreshold: 0
tactics:
- Reconnaissance
- CommandAndControl
relevantTechniques:
- T1591
- T1090
query: |
let timeframe = 24h;
BitSightGraphData
| where ingestion_time() > ago(timeframe)
| where toint(RatingDifferance) < 0
| project RatingDate, Rating, CompanyName, RatingDifferance
incidentConfiguration:
createIncident: false
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: 'BitSight : Alert for drop in the headline rating of {{CompanyName}}.'
alertDescriptionFormat: 'Alert is generated for {{CompanyName}}.\n\nRating Date: {{RatingDate}}\nRating Drop: {{RatingDifferance}}'
customDetails:
CompanyName: CompanyName
CompanyRating: Rating
version: 1.0.2
kind: Scheduled
Stages and Predicates
Parameters
let timeframe = 24h;
Stage 1: source
BitSightGraphData
Stage 2: where
| where ingestion_time() > ago(timeframe)
Stage 3: where
| where toint(RatingDifferance) < 0
Stage 4: project
| project RatingDate, Rating, CompanyName, RatingDifferance
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
RatingDifferance | lt |
| field:"RatingDifferance" kind:lt value:"0" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
CompanyName | project |
Rating | project |
RatingDate | project |
RatingDifferance | project |