Detection rules › Kusto

BitSight - drop in the headline rating

Status
available
Severity
high
Time window
1d
Source
github.com/Azure/Azure-Sentinel

'Rule helps to detect if headline ratings is drop in BitSight.'

MITRE ATT&CK coverage

TacticTechniques
Reconnaissance
Command & Control

Rule body

id: b11fdc35-6368-4cc0-8128-52cd2e2cdda0
name: BitSight - drop in the headline rating
description: |
  'Rule helps to detect if headline ratings is drop in BitSight.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: BitSight
    dataTypes:
      - BitSightGraphData
queryFrequency: 1d
queryPeriod: 24h
triggerOperator: GreaterThan
triggerThreshold: 0
tactics:
  - Reconnaissance
  - CommandAndControl
relevantTechniques:
  - T1591
  - T1090
query: |
    let timeframe = 24h;
    BitSightGraphData
    | where ingestion_time() > ago(timeframe)
    | where toint(RatingDifferance) < 0
    | project RatingDate, Rating, CompanyName, RatingDifferance
incidentConfiguration:
    createIncident: false
eventGroupingSettings:
    aggregationKind: AlertPerResult
alertDetailsOverride:
    alertDisplayNameFormat: 'BitSight : Alert for drop in the headline rating of {{CompanyName}}.'
    alertDescriptionFormat: 'Alert is generated for {{CompanyName}}.\n\nRating Date: {{RatingDate}}\nRating Drop: {{RatingDifferance}}'
customDetails:
  CompanyName: CompanyName
  CompanyRating: Rating
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let timeframe = 24h;

Stage 1: source

BitSightGraphData

Stage 2: where

| where ingestion_time() > ago(timeframe)

Stage 3: where

| where toint(RatingDifferance) < 0

Stage 4: project

| project RatingDate, Rating, CompanyName, RatingDifferance

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
RatingDifferancelt
  • 0 transforms: toint
field:"RatingDifferance" kind:lt value:"0"

Output fields

These fields are emitted when the rule matches.

FieldSource
CompanyNameproject
Ratingproject
RatingDateproject
RatingDifferanceproject