GTI - High Relevance Alert Detected

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Triggers an incident when a GTI Relevance System Alert is assessed as RELEVANCE_LEVEL_HIGH with a HIGH confidence level. High relevance means Google Threat Intelligence has determined the threat directly or very closely matches your organisation profile - regardless of threat type. These are the most actionable alerts and warrant priority investigation. Each unique Alert ID is grouped into a single incident.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts `T1566` Phishing
Privilege Escalation	`T1068` Exploitation for Privilege Escalation `T1078` Valid Accounts
Credential Access	`T1552` Unsecured Credentials
Exfiltration	`T1567` Exfiltration Over Web Service
Impact	`T1486` Data Encrypted for Impact

Rule body

id: f6a7b8c9-d0e1-2345-fabc-456789012345
name: GTI - High Relevance Alert Detected
description: |
  Triggers an incident when a GTI Relevance System Alert is assessed as RELEVANCE_LEVEL_HIGH
  with a HIGH confidence level. High relevance means Google Threat Intelligence has determined
  the threat directly or very closely matches your organisation profile - regardless of threat type.
  These are the most actionable alerts and warrant priority investigation.
  Each unique Alert ID is grouped into a single incident.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
    dataTypes:
      - RelevanceSystemAlerts_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Exfiltration
  - Impact
  - CredentialAccess
  - PrivilegeEscalation
relevantTechniques:
  - T1566
  - T1068
  - T1078
  - T1567
  - T1486
  - T1552
query: |
  GTIRelevanceSystemAlerts
  | where RelevanceLevel == "HIGH"
      and IsRelevant == true
  | extend
      DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")
  | project
      TimeGenerated,
      AlertId,
      AlertName           = DisplayName,
      AlertState          = State,
      DetailType,
      DetailSeverity,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      CommonThemes        = RelevanceEvidenceCommonThemes,
      DistinctThemes      = RelevanceEvidenceDistinctThemes,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      PriorityLevel,
      PriorityReasoning,
      FindingCount,
      AiSummary,
      AuditCreateTime,
      AuditUpdateTime
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI High Relevance Alert: {{AlertName}}'
  alertDescriptionFormat: |
    Relevance: {{RelevanceLevel}}

    Why it matches your organisation:
    {{RelevanceReasoning}}

    Summary: {{AiSummary}}
customDetails:
  AlertId: AlertId
  AlertState: AlertState
  DetailType: DetailType
  RelevanceLevel: RelevanceLevel
  RelevanceConfidence: RelevanceConfidence
  PriorityLevel: PriorityLevel
  SeverityLevel: SeverityLevel
  FindingCount: FindingCount
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P5D
    matchingMethod: Selected
    groupByCustomDetails:
      - AlertId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GTIRelevanceSystemAlerts

Stage 2: `where`

| where RelevanceLevel == "HIGH"
    and IsRelevant == true

Stage 3: `extend`

| extend
    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, "")

Stage 4: `project`

| project
    TimeGenerated,
    AlertId,
    AlertName           = DisplayName,
    AlertState          = State,
    DetailType,
    DetailSeverity,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    CommonThemes        = RelevanceEvidenceCommonThemes,
    DistinctThemes      = RelevanceEvidenceDistinctThemes,
    SeverityLevel,
    SeverityConfidence,
    SeverityReasoning,
    PriorityLevel,
    PriorityReasoning,
    FindingCount,
    AiSummary,
    AuditCreateTime,
    AuditUpdateTime

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`IsRelevant`	eq	`true`	`field:"IsRelevant" kind:eq value:"true"`
`RelevanceLevel`	eq	`HIGH`	`field:"RelevanceLevel" kind:eq value:"HIGH"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AiSummary`	`project`
`AlertId`	`project`
`AlertName`	`project`
`AlertState`	`project`
`AuditCreateTime`	`project`
`AuditUpdateTime`	`project`
`CommonThemes`	`project`
`DetailSeverity`	`project`
`DetailType`	`project`
`DistinctThemes`	`project`
`FindingCount`	`project`
`PriorityLevel`	`project`
`PriorityReasoning`	`project`
`RelevanceConfidence`	`project`
`RelevanceLevel`	`project`
`RelevanceReasoning`	`project`
`SeverityConfidence`	`project`
`SeverityLevel`	`project`
`SeverityReasoning`	`project`
`TimeGenerated`	`project`