detection.wiki

Detection rules › Kusto

Dynatrace Application Security - Code-Level runtime vulnerability detection

Status
available
Severity
medium
Time window
1d
Group by
SecurityProblemId
Source
github.com/Azure/Azure-Sentinel

Detect Code-level runtime vulnerabilities in your environment

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Execution
Persistence
Privilege Escalation
Stealth
Lateral Movement
Impact

Rule body

id: 305093b4-0fa2-57bc-bced-caea782a6e9c
name: Dynatrace Application Security - Code-Level runtime vulnerability detection
description: 'Detect Code-level runtime vulnerabilities in your environment'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: DynatraceRuntimeVulnerabilities
    dataTypes:
      - DynatraceSecurityProblems
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
  - Execution
  - Impact
  - InitialAccess
  - LateralMovement
  - Persistence
  - PrivilegeEscalation
relevantTechniques:
  - T1140
  - T1059
  - T1565
  - T1659
  - T1210
  - T1554
  - T1548
eventGroupingSettings:
  aggregationKind: AlertPerResult
query: |
  DynatraceSecurityProblems
  | where VulnerabilityType == "CODE_LEVEL" and DAVISRiskLevel == "CRITICAL" and Muted == false
  | summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Url
alertDetailsOverride:
  alertDisplayNameFormat: 'Dynatrace Code-Level runtime vulnerability detected - {{DisplayId}} : {{Title}}'
  alertDescriptionFormat: |
    Code-Level runtime vulnerability ({{ExternalVulnerabilityId}}) detected in package ({{PackageName}}), more details available from Dynatrace at {{Url}}.
  alertSeverityColumnName: Severity
customDetails:
  SecProbIdentifier: SecurityProblemId
  DisplayIdentifier: DisplayId
  SecurityProblemUrl: Url
  DAVISRiskLevel: DAVISRiskLevel
  PackageName: PackageName
  Technology: Technology
  VulnerabilityType: VulnerabilityType
  CVEIds: CVEIds
  ExternVulnIdentifier: ExternalVulnerabilityId
  DAVISRiskScore: DAVISRiskScore
  DAVISRiskVector: DAVISRiskVector
  DAVISExposure: DAVISExposure
  DAVISPublicExploit: DAVISPublicExploit
  DAVISDataAssets: DAVISDataAssets
  DAVISVulnFuncUsage: DAVISVulnerableFunctionUsage
incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
version: 1.0.4
kind: Scheduled

Stages and Predicates

Stage 1: source

DynatraceSecurityProblems

Stage 2: where

| where VulnerabilityType == "CODE_LEVEL" and DAVISRiskLevel == "CRITICAL" and Muted == false

Stage 3: summarize

| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
DAVISRiskLeveleq
  • CRITICAL
field:"DAVISRiskLevel" kind:eq value:"CRITICAL"
Mutedeq
  • false
field:"Muted" kind:eq value:"false"
VulnerabilityTypeeq
  • CODE_LEVEL
field:"VulnerabilityType" kind:eq value:"CODE_LEVEL"

Output fields

These fields are emitted when the rule matches.

FieldSource
SecurityProblemIdsummarize