GTI - High and Critical Priority Alerts

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Triggers an incident whenever a GTI Relevance System Alert with priority level HIGH or CRITICAL is ingested. These alerts indicate threats that Google Threat Intelligence has assessed as requiring immediate attention based on relevance, severity, and potential business impact. Each unique Alert ID is grouped into a single incident.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts `T1566` Phishing
Credential Access	`T1552` Unsecured Credentials
Exfiltration	`T1567` Exfiltration Over Web Service
Impact	`T1486` Data Encrypted for Impact

Rule body

id: b2c3d4e5-f6a7-8901-bcde-f12345678902
name: GTI - High and Critical Priority Alerts
description: |
  Triggers an incident whenever a GTI Relevance System Alert with priority level HIGH or CRITICAL
  is ingested. These alerts indicate threats that Google Threat Intelligence has assessed as requiring
  immediate attention based on relevance, severity, and potential business impact.
  Each unique Alert ID is grouped into a single incident.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
    dataTypes:
      - RelevanceSystemAlerts_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Impact
  - CredentialAccess
  - Exfiltration
relevantTechniques:
  - T1566
  - T1078
  - T1552
  - T1486
  - T1567
query: |
  GTIRelevanceSystemAlerts
  | where PriorityLevel in ("HIGH", "CRITICAL")
  | extend
      DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
  | project
      TimeGenerated,
      AlertId,
      AlertName          = DisplayName,
      AlertState         = State,
      PriorityLevel,
      PriorityReasoning,
      SeverityLevel,
      SeverityConfidence,
      DetailType,
      DetailSeverity,
      RelevanceLevel,
      FindingCount,
      AiSummary,
      AuditCreateTime,
      AuditUpdateTime
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI High/Critical Priority Alert: {{AlertName}}'
  alertDescriptionFormat: |
    Priority: {{PriorityLevel}}

    Priority Reasoning: {{PriorityReasoning}}

    Summary: {{AiSummary}}
customDetails:
  AlertId: AlertId
  AlertState: AlertState
  PriorityLevel: PriorityLevel
  SeverityLevel: SeverityLevel
  DetailType: DetailType
  FindingCount: FindingCount
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P5D
    matchingMethod: Selected
    groupByCustomDetails:
      - AlertId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GTIRelevanceSystemAlerts

Stage 2: `where`

| where PriorityLevel in ("HIGH", "CRITICAL")

Stage 3: `extend`

| extend
    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")

Stage 4: `project`

| project
    TimeGenerated,
    AlertId,
    AlertName          = DisplayName,
    AlertState         = State,
    PriorityLevel,
    PriorityReasoning,
    SeverityLevel,
    SeverityConfidence,
    DetailType,
    DetailSeverity,
    RelevanceLevel,
    FindingCount,
    AiSummary,
    AuditCreateTime,
    AuditUpdateTime

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`PriorityLevel`	in	`CRITICAL` `HIGH`	`field:"PriorityLevel" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AiSummary`	`project`
`AlertId`	`project`
`AlertName`	`project`
`AlertState`	`project`
`AuditCreateTime`	`project`
`AuditUpdateTime`	`project`
`DetailSeverity`	`project`
`DetailType`	`project`
`FindingCount`	`project`
`PriorityLevel`	`project`
`PriorityReasoning`	`project`
`RelevanceLevel`	`project`
`SeverityConfidence`	`project`
`SeverityLevel`	`project`
`TimeGenerated`	`project`