detection.wiki

Detection rules › Kusto

Vectra Create Detection Alert for Accounts

Status
available
Severity
medium
Time window
10m
Group by
entity_uid
Source
github.com/Azure/Azure-Sentinel

This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monitored by the Vectra Platform

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546 Event Triggered Execution

Rule body kusto

id: e796701f-6b39-4c54-bf8a-1d543a990784
name: Vectra Create Detection Alert for Accounts
version: 1.0.1
kind: Scheduled
description: This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monitored by the Vectra Platform
status: Available
requiredDataConnectors:
  - connectorId: VectraXDR
    dataTypes:
      - Detections_Data_CL
severity: Medium
queryFrequency: 10m
queryPeriod: 10m
suppressionDuration: PT1H
suppressionEnabled: false
triggerOperator: GreaterThan
triggerThreshold: 0
tactics: 
  - Persistence
relevantTechniques:
  - T1546
query: |
  VectraDetections
  | where Type == "account"
  | extend
      entity_uid = ['Entity UID'],
      entity_id = ['Entity ID'],
      entity_type = ['Entity Type'],
      detection_id = ['Detection ID'],
      detection = ['Detection Name'],
      category = ['Detection Category'],
      detection_url = ['Vectra Pivot'],
      mitre = Mitre,
      tags = Tags
  | summarize arg_max(TimeGenerated, *) by ['Detection ID'], entity_uid
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: entity_uid
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
customDetails:
  entity_id: entity_id
  tags: tags
  entity_type: entity_type
  detection_id: detection_id
  mitre_techniques: mitre
alertDetailsOverride:
  alertDisplayNameFormat: Vectra AI Detection-  {{detection}}
  alertDescriptionFormat: Vectra AI has detected {{category}} - {{detection} on entity {{entity_uid}}.
  alertDynamicProperties:
  - alertProperty: AlertLink
    value: detection_url
eventGroupingSettings:
  aggregationKind: AlertPerResult

Stages and Predicates

Stage 1: source

VectraDetections

Stage 2: where

| where Type == "account"

Stage 3: extend

| extend
    entity_uid = ['Entity UID'],
    entity_id = ['Entity ID'],
    entity_type = ['Entity Type'],
    detection_id = ['Detection ID'],
    detection = ['Detection Name'],
    category = ['Detection Category'],
    detection_url = ['Vectra Pivot'],
    mitre = Mitre,
    tags = Tags

Stage 4: summarize

| summarize arg_max(TimeGenerated, *) by ['Detection ID'], entity_uid

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Typeeq
  • account transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
entity_uidsummarize