GTI - Initial Access Broker Alert Detected

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Triggers an incident when a GTI Relevance System Alert of type initial_access_broker is ingested. Initial Access Broker alerts indicate that a threat actor is advertising or has sold access (credentials, VPN, RDP, admin panels, etc.) to an organisation that matches your profile. These are high-urgency signals that may indicate imminent compromise or an ongoing breach. Each unique Alert ID is grouped into a single incident.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts `T1133` External Remote Services `T1190` Exploit Public-Facing Application
Credential Access	`T1552` Unsecured Credentials

Rule body

id: c3d4e5f6-a7b8-9012-cdef-123456789013
name: GTI - Initial Access Broker Alert Detected
description: |
  Triggers an incident when a GTI Relevance System Alert of type initial_access_broker is ingested.
  Initial Access Broker alerts indicate that a threat actor is advertising or has sold access
  (credentials, VPN, RDP, admin panels, etc.) to an organisation that matches your profile.
  These are high-urgency signals that may indicate imminent compromise or an ongoing breach.
  Each unique Alert ID is grouped into a single incident.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
    dataTypes:
      - RelevanceSystemAlerts_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - CredentialAccess
relevantTechniques:
  - T1078
  - T1133
  - T1190
  - T1552
query: |
  GTIRelevanceSystemAlerts
  | where DetailType == "initial_access_broker"
  | project
      TimeGenerated,
      AlertId,
      AlertName                       = DisplayName,
      AlertState                      = State,
      BrokerSeverity                  = InitialAccessBrokerSeverity,
      DiscoveryDocuments              = InitialAccessBrokerDiscoveryDocumentIds,
      PriorityLevel,
      PriorityReasoning,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      CommonThemes                    = RelevanceEvidenceCommonThemes,
      DistinctThemes                  = RelevanceEvidenceDistinctThemes,
      AuditCreateTime,
      AuditUpdateTime
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Initial Access Broker: {{AlertName}}'
  alertDescriptionFormat: |
    Broker Severity: {{BrokerSeverity}} | Priority: {{PriorityLevel}}

    Summary: {{AiSummary}}
customDetails:
  AlertId: AlertId
  AlertState: AlertState
  BrokerSeverity: BrokerSeverity
  PriorityLevel: PriorityLevel
  SeverityLevel: SeverityLevel
  RelevanceLevel: RelevanceLevel
  FindingCount: FindingCount
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P5D
    matchingMethod: Selected
    groupByCustomDetails:
      - AlertId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GTIRelevanceSystemAlerts

Stage 2: `where`

| where DetailType == "initial_access_broker"

Stage 3: `project`

| project
    TimeGenerated,
    AlertId,
    AlertName                       = DisplayName,
    AlertState                      = State,
    BrokerSeverity                  = InitialAccessBrokerSeverity,
    DiscoveryDocuments              = InitialAccessBrokerDiscoveryDocumentIds,
    PriorityLevel,
    PriorityReasoning,
    SeverityLevel,
    SeverityConfidence,
    SeverityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    CommonThemes                    = RelevanceEvidenceCommonThemes,
    DistinctThemes                  = RelevanceEvidenceDistinctThemes,
    AuditCreateTime,
    AuditUpdateTime

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DetailType`	eq	`initial_access_broker`	`field:"DetailType" kind:eq value:"initial_access_broker"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AiSummary`	`project`
`AlertId`	`project`
`AlertName`	`project`
`AlertState`	`project`
`AuditCreateTime`	`project`
`AuditUpdateTime`	`project`
`BrokerSeverity`	`project`
`CommonThemes`	`project`
`DiscoveryDocuments`	`project`
`DistinctThemes`	`project`
`FindingCount`	`project`
`PriorityLevel`	`project`
`PriorityReasoning`	`project`
`RelevanceConfidence`	`project`
`RelevanceLevel`	`project`
`RelevanceReasoning`	`project`
`SeverityConfidence`	`project`
`SeverityLevel`	`project`
`SeverityReasoning`	`project`
`TimeGenerated`	`project`