Dynatrace Application Security - Attack detection

id: 1b0b2065-8bac-5a00-83c4-1b58f69ac212
name: Dynatrace Application Security - Attack detection
description: |
  'Dynatrace has detected an ongoing attack in your environment.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: DynatraceAttacks
    dataTypes:
      - DynatraceAttacks
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - Impact
  - InitialAccess
  - PrivilegeEscalation
relevantTechniques:
  - T1059
  - T1565
  - T1190
  - T1068
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  DynatraceAttacks
  | where State != 'ALLOWLISTED'
  | summarize  arg_max(TimeStamp, *) by AttackId
alertDetailsOverride:
  alertDisplayNameFormat: 'Dynatrace Attack {{State}} - {{DisplayId}} : {{DisplayName}}'
  alertDescriptionFormat: |
    Dynatrace has detected an ongoing attack in your environment which was {{State}}.
customDetails:
  AttackIdentifier: AttackId
  AttackType: AttackType
  AttackState: State
  DisplayIdentifier: DisplayId
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: true
    lookbackDuration: P7D
    matchingMethod: AllEntities
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: host
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: url
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourceIp
version: 1.0.1
kind: Scheduled