Claroty - New Asset

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device or system has been discovered and should be reviewed for authorization, ownership, and expected network placement.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1133` External Remote Services `T1190` Exploit Public-Facing Application
Discovery	`T1082` System Information Discovery

Rule body

id: 6c29b611-ce69-4016-bf99-eca639fee1f5
name: Claroty - New Asset
description: |
  'Triggers when Claroty reports a new asset event in the environment, indicating that a previously unseen device
  or system has been discovered and should be reviewed for authorization, ownership, and expected network placement.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Discovery
relevantTechniques:
  - T1190
  - T1133
  - T1082
query: |
  ClarotyEvent
  | where EventOriginalType has 'New Asset' or EventType has 'New Asset'
  | extend IPCustomEntity = SrcIpAddr
  | extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))
  | extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')
  | project IPCustomEntity, AlertTitle, AlertDescription
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.4
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ClarotyEvent

Stage 2: `where`

| where EventOriginalType has 'New Asset' or EventType has 'New Asset'

Stage 3: `extend` (3 consecutive steps)

| extend IPCustomEntity = SrcIpAddr
| extend AlertTitle = strcat('Claroty new asset detected from ', coalesce(SrcIpAddr, 'unknown source'))
| extend AlertDescription = strcat('Claroty reported a new asset event from source IP ', coalesce(SrcIpAddr, 'unknown'), '.')

Stage 4: `project`

| project IPCustomEntity, AlertTitle, AlertDescription

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventOriginalType`	match	`New Asset` transforms: `term`	`field:"EventOriginalType" kind:match value:"New Asset"`
`EventType`	match	`New Asset` transforms: `term`	`field:"EventType" kind:match value:"New Asset"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AlertDescription`	`project`
`AlertTitle`	`project`
`IPCustomEntity`	`project`