Claroty - Policy violation

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Detects Claroty policy violation events from ClarotyEvent when EventOriginalType or EventType contains 'Policy Violation'. Use this rule to identify policy enforcement events that may indicate unauthorized discovery or prohibited network activity. This rule expects ClarotyEvent data to be available in the workspace.'

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1018` Remote System Discovery `T1135` Network Share Discovery

Rule body

id: 3b22ac47-e02c-4599-a37a-57f965de17be
name: Claroty - Policy violation
description: |
  'Detects Claroty policy violation events from ClarotyEvent when EventOriginalType or EventType contains 'Policy
  Violation'. Use this rule to identify policy enforcement events that may indicate unauthorized discovery or prohibited network
  activity. This rule expects ClarotyEvent data to be available in the workspace.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CefAma
    dataTypes:
      - CommonSecurityLog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
relevantTechniques:
  - T1018
  - T1135
query: |
  ClarotyEvent
    | where EventOriginalType has 'Policy Violation' or EventType has 'Policy Violation'
    | project TimeGenerated, DstIpAddr, EventOriginalType, EventType
    | extend IPCustomEntity = DstIpAddr
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
alertDetailsOverride:
  alertDisplayNameFormat: Claroty policy violation detected for {{IPCustomEntity}}
  alertDescriptionFormat: 'Claroty reported a policy violation for {{IPCustomEntity}}. EventOriginalType: {{EventOriginalType}}.
    EventType: {{EventType}}'
customDetails:
  EventOriginalType: EventOriginalType
  EventType: EventType
  DestinationIP: DstIpAddr
version: 1.0.4
kind: Scheduled

Stages and Predicates

Stage 1: `source`

ClarotyEvent

Stage 2: `where`

| where EventOriginalType has 'Policy Violation' or EventType has 'Policy Violation'

Stage 3: `project`

| project TimeGenerated, DstIpAddr, EventOriginalType, EventType

Stage 4: `extend`

| extend IPCustomEntity = DstIpAddr

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventOriginalType`	match	`Policy Violation` transforms: `term`	`field:"EventOriginalType" kind:match value:"Policy Violation"`
`EventType`	match	`Policy Violation` transforms: `term`	`field:"EventType" kind:match value:"Policy Violation"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DstIpAddr`	`project`
`EventOriginalType`	`project`
`EventType`	`project`
`TimeGenerated`	`project`
`IPCustomEntity`	`extend`