detection.wiki

Detection rules › Kusto

Darktrace Model Alert

Severity
high
Source
github.com/Azure/Azure-Sentinel

This query searches for Darktrace model alerts and creates a Microsoft Sentinel alert from each matching event. Edit this analytic rule if you would like it to create Microsoft Sentinel incidents.

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Execution
Lateral Movement
Command & Control

Rule body

id: 9392a06f-63a4-4a5d-8ca3-647064b13c28
name: Darktrace Model Alert
kind: NRT
description: |
  This query searches for Darktrace model alerts and creates a Microsoft Sentinel alert
  from each matching event. Edit this analytic rule if you would like it to create
  Microsoft Sentinel incidents.
severity: High
requiredDataConnectors:
  - connectorId: DarktraceActiveAISecurityPlatform
    dataTypes:
      - DarktraceModelAlerts_CL
tactics:
  - InitialAccess
  - Execution
  - LateralMovement
  - CommandAndControl
relevantTechniques:
  - T1190
  - T1059
  - T1021
  - T1071
query: |
  DarktraceModelAlerts_CL
  | where TimeGenerated >= ago(5m)
  | extend SentinelSeverity = case(
  compliance == true, "Informational",
  category == "Informational", "Low",
  category == "Suspicious", "Medium",
  category == "Critical", "High",
  "Informational")
  | extend ProviderName = "Darktrace"
  | mv-apply item = mitreTechniques on (
      extend techniqueId = tostring(item.techniqueId)
      | summarize techniqueIdArray = make_list(techniqueId, 5)
  )
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: accountName
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourceIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: destIp
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: destHost
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: sourceHost
customDetails:
  DeviceHostname: deviceHostname
  DeviceCredentials: deviceCredentials
  Compliance: compliance
  Score: score
  CustomLabel: customLabel
  Category: category
alertDetailsOverride:
  alertDisplayNameFormat: 'Darktrace Model Alert: {{modelName}}  '
  alertDescriptionFormat: '{{message}}'
  alertSeverityColumnName: SentinelSeverity
  alertDynamicProperties:
    - alertProperty: AlertLink
      value: alertUrl
    - alertProperty: ProductName
      value: darktraceProduct
    - alertProperty: ProviderName
      value: ProviderName
    - alertProperty: Techniques
      value: techniqueIdArray
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
version: 1.1.0

Stages and Predicates

Stage 1: source

DarktraceModelAlerts_CL

Stage 2: where

| where TimeGenerated >= ago(5m)

Stage 3: extend

| extend SentinelSeverity = case(
compliance == true, "Informational",
category == "Informational", "Low",
category == "Suspicious", "Medium",
category == "Critical", "High",
"Informational")
SentinelSeverity =
ifcompliance == true"Informational"
elifcategory == "Informational""Low"
elifcategory == "Suspicious""Medium"
elifcategory == "Critical""High"
else"Informational"

Stage 4: extend

| extend ProviderName = "Darktrace"

Stage 5: kusto:mv-apply

| mv-apply item = mitreTechniques on (
    extend techniqueId = tostring(item.techniqueId)
    | summarize techniqueIdArray = make_list(techniqueId, 5)
)

Stage 6: summarize aggregation inside the mv-apply branch

summarize