detection.wiki

Detection rules › Kusto

DomainTools Newly Added Domains Feeds Ingested

Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

Creates an incident whenever DomainTools Newly Added Domains new Feeds (domains) are ingested in the last 1 hour.

Rule body

id: f8c223c1-1a28-4b28-8e9f-5e34b610916b
name: DomainTools Newly Added Domains Feeds Ingested
description: Creates an incident whenever DomainTools Newly Added Domains new Feeds (domains) are ingested in the last 1 hour.
kind: Scheduled
severity: Medium
requiredDataConnectors:
  - connectorId: DomainTools
    dataTypes:
      - DomainToolsThreatIntelDomains_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: "DomainToolsThreatIntelDomains(1h,\"nad\")"
entityMappings:
  - entityType: DNS
    fieldMappings:
      - identifier: DomainName
        columnName: DomainCustomEntity
eventGroupingSettings:
  aggregationKind: SingleAlert
version: 1.0.0

Stages and Predicates

Stage 1: source

DomainToolsThreatIntelDomains(1h,"nad")