detection.wiki

Detection rules › Kusto

Commvault Cloud Alert

Status
available
Severity
medium
Time window
5m
Source
github.com/Azure/Azure-Sentinel

'This query identifies Alerts from Commvault Cloud.'

MITRE ATT&CK coverage

TacticTechniques
Defense Impairment
Impact

Rule body

id: 317e757e-c320-448e-8837-fc61a70fe609
name: Commvault Cloud Alert
description: |
  'This query identifies Alerts from Commvault Cloud.'
severity: Medium
status: Available
enabled: true
requiredDataConnectors:
  - connectorId: CommvaultSecurityIQConnector
    datatypes:
      - CommvaultAlertsCCF_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
  - Impact
customDetails:
  Client: ClientName
  AnomalyType: AnomalyType
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Commvault Cloud Anomaly detected for client: {{ClientName}}'
  alertDescriptionFormat: 'Anomaly detected for Commvault client {{ClientName}}. AnomalyType flag: {{AnomalyType}}.'
  alertDynamicProperties: []
relevantTechniques:
  - T1578
  - T1531
tags:
  - Commvault
  - Metallic
  - Threat Intelligence
  - Ransomware
query: |
    CommvaultAlertsCCF_CL
    | where TimeGenerated > ago(5m)
    | where isnotnull(AnomalyType) and AnomalyType > 0
    | take 1000
entityMappings: null
version: 1.0.6
kind: Scheduled

Stages and Predicates

Stage 1: source

CommvaultAlertsCCF_CL

Stage 2: where

| where TimeGenerated > ago(5m)

Stage 3: where

| where isnotnull(AnomalyType) and AnomalyType > 0

Stage 4: take

| take 1000

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
AnomalyTypegt
  • 0
field:"AnomalyType" kind:gt value:"0"
AnomalyTypeis_not_null
  • (no value, null check)
field:"AnomalyType" kind:is_not_null