Claroty - Critical baseline deviation

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

Detects Claroty events where EventOriginalType or EventType indicates a Baseline Deviation and EventSeverity is 5, which represents a critical deviation from baseline that may indicate disruptive or unauthorized activity.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1529` System Shutdown/Reboot `T1565.001` Data Manipulation: Stored Data Manipulation

Rule body

id: 9a8b4321-e2be-449b-8227-a78227441b2a
name: Claroty - Critical baseline deviation
description: Detects Claroty events where EventOriginalType or EventType indicates a Baseline Deviation and EventSeverity
  is 5, which represents a critical deviation from baseline that may indicate disruptive or unauthorized activity.
severity: High
status: Available
requiredDataConnectors:
- connectorId: CefAma
  dataTypes:
  - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
relevantTechniques:
- T1529
- T1565.001
query: |-
  ClarotyEvent
  | where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'
  | where EventSeverity == '5'
  | project TimeGenerated, DstIpAddr
  | extend IPCustomEntity = DstIpAddr
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
alertDetailsOverride:
  alertDisplayNameFormat: Claroty critical baseline deviation on {{IPCustomEntity}}
  alertDescriptionFormat: Claroty reported a critical baseline deviation for {{IPCustomEntity}}.
version: 1.0.4
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ClarotyEvent

Stage 2: `where`

| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'

Stage 3: `where`

| where EventSeverity == '5'

Stage 4: `project`

| project TimeGenerated, DstIpAddr

Stage 5: `extend`

| extend IPCustomEntity = DstIpAddr

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventOriginalType`	match	`Baseline Deviation` transforms: `term`	`field:"EventOriginalType" kind:match value:"Baseline Deviation"`
`EventSeverity`	eq	`5`	`field:"EventSeverity" kind:eq value:"5"`
`EventType`	match	`Baseline Deviation` transforms: `term`	`field:"EventType" kind:match value:"Baseline Deviation"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DstIpAddr`	`project`
`TimeGenerated`	`project`
`IPCustomEntity`	`extend`

Claroty - Critical baseline deviation

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: project