detection.wiki

Detection rules › Kusto

Dynatrace Application Security - Attack detection

Status
available
Severity
high
Time window
1d
Group by
AttackId
Source
github.com/Azure/Azure-Sentinel

'Dynatrace has detected an ongoing attack in your environment.'

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application
ExecutionT1059 Command and Scripting Interpreter
Privilege EscalationT1068 Exploitation for Privilege Escalation
ImpactT1565 Data Manipulation

Rule body kusto

id: 1b0b2065-8bac-5a00-83c4-1b58f69ac212
name: Dynatrace Application Security - Attack detection
description: |
  'Dynatrace has detected an ongoing attack in your environment.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: DynatraceAttacks
    dataTypes:
      - DynatraceAttacks
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - Impact
  - InitialAccess
  - PrivilegeEscalation
relevantTechniques:
  - T1059
  - T1565
  - T1190
  - T1068
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  DynatraceAttacks
  | where State != 'ALLOWLISTED'
  | summarize  arg_max(TimeStamp, *) by AttackId
alertDetailsOverride:
  alertDisplayNameFormat: 'Dynatrace Attack {{State}} - {{DisplayId}} : {{DisplayName}}'
  alertDescriptionFormat: |
    Dynatrace has detected an ongoing attack in your environment which was {{State}}.
customDetails:
  AttackIdentifier: AttackId
  AttackType: AttackType
  AttackState: State
  DisplayIdentifier: DisplayId
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: true
    lookbackDuration: P7D
    matchingMethod: AllEntities
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: host
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: url
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourceIp
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: source

DynatraceAttacks

Stage 2: where

| where State != 'ALLOWLISTED'

Stage 3: summarize

| summarize  arg_max(TimeStamp, *) by AttackId

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Statene
  • ALLOWLISTED transforms: cased

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
AttackIdsummarize