Google SecOps - Multi-Event Correlated Alert

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

Creates incidents in Microsoft Sentinel when Google Security Operations raises an active multi-event correlated alert (MULTI_EVENT, riskScore gte 40) at HIGH or CRITICAL severity. These alerts indicate complex attack patterns like lateral movement, staged persistence, or command-and-control identified by correlating multiple signals across a time window.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1053` Scheduled Task/Job
Privilege Escalation	`T1053` Scheduled Task/Job `T1055` Process Injection
Lateral Movement	`T1021` Remote Services `T1210` Exploitation of Remote Services

Rule body

id: d4f8a032-6d5b-4e9f-b3a0-8c2e4f7d0b6e
name: Google SecOps - Multi-Event Correlated Alert
description: |
  Creates incidents in Microsoft Sentinel when Google Security Operations raises an active multi-event correlated alert (MULTI_EVENT, riskScore gte 40) at HIGH or CRITICAL severity. These alerts indicate complex attack patterns like lateral movement, staged persistence, or command-and-control identified by correlating multiple signals across a time window.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GSDetectionAlerts
    dataTypes:
      - DetectionAlerts_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
  - Persistence
  - PrivilegeEscalation
  - CommandAndControl
relevantTechniques:
  - T1210
  - T1021
  - T1053
  - T1055
query: |
  GoogleSecOpsDetectionAlerts
  | where ruleType == "MULTI_EVENT"
  | where severity in ("HIGH", "CRITICAL")
  | where riskScore >= 40
  | where alertState == "ALERTING"
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varPrincipalIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varTargetIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varSourceIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varCorrelationIp
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: urlBackToProduct
customDetails:
  RuleName: ruleName
  RuleType: ruleType
  Severity: severity
  RiskScore: riskScore
  SourceIPCount: varSourceIpCount
  PrincipalIPCount: varPrincipalIpCount
  DetectionTime: detectionTime
  PrincipalIP: varPrincipalIp
  TargetIP: varTargetIp
  SourceIP: varSourceIp
  CorrelationIP: varCorrelationIp
  PrincipalHostname: varPrincipalHostname
  TargetHostname: varTargetHostname
  SourceHostname: varSourceHostname
  PrincipalUser: varPrincipalUserUserid
  SourceUser: varSourceUserUserid
  TargetUser: varTargetUserUserid
  alert_identifier: id
alertDetailsOverride:
  alertDisplayNameFormat: "Multi-Event Correlation: {{ruleName}} : {{id}}"
  alertDescriptionFormat: "Google SecOps correlated multiple events into a confirmed alert. Rule: {{ruleName}}."
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: true
    lookbackDuration: P1D
    matchingMethod: Selected
    groupByCustomDetails:
      - alert_identifier
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GoogleSecOpsDetectionAlerts

Stage 2: `where`

| where ruleType == "MULTI_EVENT"

Stage 3: `where`

| where severity in ("HIGH", "CRITICAL")

Stage 4: `where`

| where riskScore >= 40

Stage 5: `where`

| where alertState == "ALERTING"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`alertState`	eq	`ALERTING`	`field:"alertState" kind:eq value:"ALERTING"`
`riskScore`	ge	`40`	`field:"riskScore" kind:ge value:"40"`
`ruleType`	eq	`MULTI_EVENT`	`field:"ruleType" kind:eq value:"MULTI_EVENT"`
`severity`	in	`CRITICAL` `HIGH`	`field:"severity" kind:in`

Google SecOps - Multi-Event Correlated Alert

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where