GTI - Insider Threat Alert Detected

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Triggers an incident when a GTI Relevance System Alert of type insider_threat is ingested. Insider Threat alerts indicate that GTI has identified intelligence suggesting malicious or negligent activity by individuals with legitimate access to your organisation - such as employee credential sales, internal data exposure, or rogue employee activity observed in underground sources. Each unique Alert ID is grouped into a single incident.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1068` Exploitation for Privilege Escalation `T1078` Valid Accounts
Credential Access	`T1552` Unsecured Credentials
Exfiltration	`T1567` Exfiltration Over Web Service
Impact	`T1485` Data Destruction

Rule body

id: e5f6a7b8-c9d0-1234-efab-345678901234
name: GTI - Insider Threat Alert Detected
description: |
  Triggers an incident when a GTI Relevance System Alert of type insider_threat is ingested.
  Insider Threat alerts indicate that GTI has identified intelligence suggesting malicious or negligent
  activity by individuals with legitimate access to your organisation - such as employee credential
  sales, internal data exposure, or rogue employee activity observed in underground sources.
  Each unique Alert ID is grouped into a single incident.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GoogleThreatIntelligenceRelevanceSystemAlertsAPI
    dataTypes:
      - RelevanceSystemAlerts_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
  - Exfiltration
  - CredentialAccess
  - Impact
relevantTechniques:
  - T1068
  - T1078
  - T1567
  - T1552
  - T1485
query: |
  GTIRelevanceSystemAlerts
  | where DetailType == "insider_threat"
  | project
      TimeGenerated,
      AlertId,
      AlertName           = DisplayName,
      AlertState          = State,
      InsiderSeverity     = InsiderThreatSeverity,
      DiscoveryDocuments  = InsiderThreatDiscoveryDocumentIds,
      PriorityLevel,
      PriorityReasoning,
      SeverityLevel,
      SeverityConfidence,
      SeverityReasoning,
      RelevanceLevel,
      RelevanceConfidence,
      RelevanceReasoning,
      FindingCount,
      AiSummary,
      CommonThemes        = RelevanceEvidenceCommonThemes,
      DistinctThemes      = RelevanceEvidenceDistinctThemes,
      AuditCreateTime,
      AuditUpdateTime
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Insider Threat: {{AlertName}}'
  alertDescriptionFormat: |
    Insider Severity: {{InsiderSeverity}} | Priority: {{PriorityLevel}}

    Summary: {{AiSummary}}
customDetails:
  AlertId: AlertId
  AlertState: AlertState
  InsiderSeverity: InsiderSeverity
  PriorityLevel: PriorityLevel
  SeverityLevel: SeverityLevel
  RelevanceLevel: RelevanceLevel
  FindingCount: FindingCount
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P5D
    matchingMethod: Selected
    groupByCustomDetails:
      - AlertId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GTIRelevanceSystemAlerts

Stage 2: `where`

| where DetailType == "insider_threat"

Stage 3: `project`

| project
    TimeGenerated,
    AlertId,
    AlertName           = DisplayName,
    AlertState          = State,
    InsiderSeverity     = InsiderThreatSeverity,
    DiscoveryDocuments  = InsiderThreatDiscoveryDocumentIds,
    PriorityLevel,
    PriorityReasoning,
    SeverityLevel,
    SeverityConfidence,
    SeverityReasoning,
    RelevanceLevel,
    RelevanceConfidence,
    RelevanceReasoning,
    FindingCount,
    AiSummary,
    CommonThemes        = RelevanceEvidenceCommonThemes,
    DistinctThemes      = RelevanceEvidenceDistinctThemes,
    AuditCreateTime,
    AuditUpdateTime

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DetailType`	eq	`insider_threat`	`field:"DetailType" kind:eq value:"insider_threat"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AiSummary`	`project`
`AlertId`	`project`
`AlertName`	`project`
`AlertState`	`project`
`AuditCreateTime`	`project`
`AuditUpdateTime`	`project`
`CommonThemes`	`project`
`DiscoveryDocuments`	`project`
`DistinctThemes`	`project`
`FindingCount`	`project`
`InsiderSeverity`	`project`
`PriorityLevel`	`project`
`PriorityReasoning`	`project`
`RelevanceConfidence`	`project`
`RelevanceLevel`	`project`
`RelevanceReasoning`	`project`
`SeverityConfidence`	`project`
`SeverityLevel`	`project`
`SeverityReasoning`	`project`
`TimeGenerated`	`project`