Google SecOps - Detection Alerts

Status: available
Severity: medium
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

Creates one incident per active Google Security Operations detection alert in Microsoft Sentinel. Covers all rule types and severity levels with no additional filtering, providing broad visibility across all Google SecOps alerts. Use alongside focused rules for complete detection coverage.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts `T1566` Phishing
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts
Lateral Movement	`T1021` Remote Services

Rule body

id: f6b0c254-8f7d-4a1b-d5c2-0e4a6b9f2d8a
name: Google SecOps - Detection Alerts
description: |
  Creates one incident per active Google Security Operations detection alert in Microsoft Sentinel. Covers all rule types and severity levels with no additional filtering, providing broad visibility across all Google SecOps alerts. Use alongside focused rules for complete detection coverage.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: GSDetectionAlerts
    dataTypes:
      - DetectionAlerts_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - DefenseEvasion
  - LateralMovement
  - PrivilegeEscalation
  - CommandAndControl
relevantTechniques:
  - T1078
  - T1021
  - T1566
query: |
  GoogleSecOpsDetectionAlerts
  | where alertState == "ALERTING"
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varPrincipalIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varTargetIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varSourceIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varCorrelationIp
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: urlBackToProduct
customDetails:
  alert_identifier: id
  RuleName: ruleName
  RuleId: ruleId
  RuleType: ruleType
  Severity: severity
  RiskScore: riskScore
  AlertState: alertState
  DetectionType: detectionType
  DetectionTime: detectionTime
  PrincipalIP: varPrincipalIp
  TargetIP: varTargetIp
  SourceIP: varSourceIp
  CorrelationIP: varCorrelationIp
  PrincipalHostname: varPrincipalHostname
  TargetHostname: varTargetHostname
  SourceHostname: varSourceHostname
  PrincipalUser: varPrincipalUserUserid
  SourceUser: varSourceUserUserid
  TargetUser: varTargetUserUserid
alertDetailsOverride:
  alertDisplayNameFormat: "Google SecOps Alert: {{ruleName}} : {{id}}"
  alertDescriptionFormat: "Google SecOps detection alert. Rule: {{ruleName}}. Severity: {{severity}}. Type: {{ruleType}}."
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: Selected
    groupByCustomDetails:
      - alert_identifier
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GoogleSecOpsDetectionAlerts

Stage 2: `where`

| where alertState == "ALERTING"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`alertState`	eq	`ALERTING`	`field:"alertState" kind:eq value:"ALERTING"`