Google SecOps - Single-Event Alert

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

Creates incidents in Microsoft Sentinel when Google Security Operations raises an active single-event alert (SINGLE_EVENT, riskScore gte 40) at MEDIUM, HIGH, or CRITICAL severity. These alerts represent a single action like malware execution, credential abuse, or defense evasion severe enough to trigger an incident without requiring multi-signal correlation.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Defense Impairment	`T1685` Disable or Modify Tools
Credential Access	`T1110` Brute Force
Impact	`T1485` Data Destruction

Rule body

id: e5a9b143-7e6c-4f0a-c4b1-9d3f5a8e1c7f
name: Google SecOps - Single-Event Alert
description: |
  Creates incidents in Microsoft Sentinel when Google Security Operations raises an active single-event alert (SINGLE_EVENT, riskScore gte 40) at MEDIUM, HIGH, or CRITICAL severity. These alerts represent a single action like malware execution, credential abuse, or defense evasion severe enough to trigger an incident without requiring multi-signal correlation.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GSDetectionAlerts
    dataTypes:
      - DetectionAlerts_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - CredentialAccess
  - DefenseEvasion
  - Impact
relevantTechniques:
  - T1059
  - T1110
  - T1562
  - T1485
query: |
  GoogleSecOpsDetectionAlerts
  | where ruleType == "SINGLE_EVENT"
  | where severity in ("HIGH", "CRITICAL", "MEDIUM")
  | where riskScore >= 40
  | where alertState == "ALERTING"
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varPrincipalIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varTargetIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varSourceIp
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: varCorrelationIp
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: urlBackToProduct
customDetails:
  RuleName: ruleName
  RuleType: ruleType
  Severity: severity
  RiskScore: riskScore
  DetectionTime: detectionTime
  PrincipalIP: varPrincipalIp
  TargetIP: varTargetIp
  SourceIP: varSourceIp
  CorrelationIP: varCorrelationIp
  PrincipalHostname: varPrincipalHostname
  TargetHostname: varTargetHostname
  SourceHostname: varSourceHostname
  PrincipalUser: varPrincipalUserUserid
  SourceUser: varSourceUserUserid
  TargetUser: varTargetUserUserid
  alert_identifier: id
alertDetailsOverride:
  alertDisplayNameFormat: "Single-Event : {{ruleName}} : {{id}}"
  alertDescriptionFormat: "Google SecOps flagged a single high-severity event as an active alert requiring immediate action. Rule: {{ruleName}}."
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: Selected
    groupByCustomDetails:
      - alert_identifier
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GoogleSecOpsDetectionAlerts

Stage 2: `where`

| where ruleType == "SINGLE_EVENT"

Stage 3: `where`

| where severity in ("HIGH", "CRITICAL", "MEDIUM")

Stage 4: `where`

| where riskScore >= 40

Stage 5: `where`

| where alertState == "ALERTING"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`alertState`	eq	`ALERTING`	`field:"alertState" kind:eq value:"ALERTING"`
`riskScore`	ge	`40`	`field:"riskScore" kind:ge value:"40"`
`ruleType`	eq	`SINGLE_EVENT`	`field:"ruleType" kind:eq value:"SINGLE_EVENT"`
`severity`	in	`CRITICAL` `HIGH` `MEDIUM`	`field:"severity" kind:in`

Google SecOps - Single-Event Alert

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where