detection.wiki

Detection rules › Kusto

Gambit Security - Critical Policy Issue Promotion

Status
available
Severity
high
Time window
1d
Source
github.com/Azure/Azure-Sentinel

'Creates an incident when Gambit Security reports an Active, High-severity policy issue in Microsoft Sentinel.'

MITRE ATT&CK coverage

TacticTechniques
Impact

Rule body

id: 8d2b6f4c-1a37-4e9b-b5c8-7f0e3a2d9c14
name: Gambit Security - Critical Policy Issue Promotion
description: |
  'Creates an incident when Gambit Security reports an Active, High-severity policy issue in Microsoft Sentinel.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GambitSecurityPush
    dataTypes:
      - GambitPoliciesIssues_CL
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1490
query: |
  GambitPoliciesIssues
  | where State == "Active" and Severity == "High"
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  PolicyName: PolicyName
  PolicyCategories: PolicyCategories
  IssueStatus: IssueStatus
  AffectedSystems: AffectedSystems
  Environment: Environment
  RemediationSteps: RemediationSteps
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: ResourceDisplayId
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: ResourceDisplayId
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

GambitPoliciesIssues

Stage 2: where

| where State == "Active" and Severity == "High"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Severityeq
  • High
field:"Severity" kind:eq value:"High"
Stateeq
  • Active
field:"State" kind:eq value:"Active"