Detection rules › Kusto
Illumio Enforcement Change Analytic Rule
'Create Microsoft Sentinel Incident When Ven Changes Enforcement State from Full/Selective To Idle/Visibility state'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Rule body
id: 599fdc92-eb6d-4b54-8d79-2a3f740a846a
name: Illumio Enforcement Change Analytic Rule
description: |
'Create Microsoft Sentinel Incident When Ven Changes Enforcement State from Full/Selective To Idle/Visibility state'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: IllumioSaaSDataConnector
dataTypes:
- Illumio_Auditable_Events_CL
- connectorId: SyslogAma
datatypes:
- Syslog
queryFrequency: 60m
queryPeriod: 60m
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
query: |
let enf_state = dynamic(["full", "selective"]);
let visibility_state = dynamic(["visibility_only", "idle"]);
Illumio_Auditable_Events_CL
| union IllumioSyslogAuditEvents
| extend temp_resource_changes = parse_json(resource_changes)[0]
| where event_type == 'workloads.update'
| extend old_mode = temp_resource_changes.changes.enforcement_mode.before,
new_mode = temp_resource_changes.changes.enforcement_mode.after,
workload_href = temp_resource_changes.resource.workload.href,
workload_name = temp_resource_changes.resource.workload.hostname,
ipaddress = action.src_ip
| where new_mode in (visibility_state) and old_mode in (enf_state)
| project-away temp_*
| project old_mode, new_mode, workload_href, workload_name, TimeGenerated, created_by, ipaddress
eventGroupingSettings:
aggregationKind: SingleAlert
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: workload_name
- entityType: Account
fieldMappings:
- identifier: Name
columnName: created_by
- entityType: IP
fieldMappings:
- identifier: Address
columnName: ipaddress
alertDetailsOverride:
alertDisplayNameFormat: |
Illumio Enforcement Change Incident for {{workload_name}}
alertDescriptionFormat: |
Illumio Enforcement Change Incident for {{workload_name}} generated at {{TimeGenerated}}
version: 1.0.7
kind: Scheduled
Stages and Predicates
Parameters
let enf_state = dynamic(["full", "selective"]);
let visibility_state = dynamic(["visibility_only", "idle"]);
Stage 1: source
Illumio_Auditable_Events_CL
Stage 2: union
| union IllumioSyslogAuditEvents
Stage 3: source
IllumioSyslogAuditEvents
Stage 4: extend
| extend temp_resource_changes = parse_json(resource_changes)[0]
Stage 5: where
| where event_type == 'workloads.update'
Stage 6: extend
| extend old_mode = temp_resource_changes.changes.enforcement_mode.before,
new_mode = temp_resource_changes.changes.enforcement_mode.after,
workload_href = temp_resource_changes.resource.workload.href,
workload_name = temp_resource_changes.resource.workload.hostname,
ipaddress = action.src_ip
Stage 7: where
| where new_mode in (visibility_state) and old_mode in (enf_state)
Stage 8: project-away
| project-away temp_*
Stage 9: project
| project old_mode, new_mode, workload_href, workload_name, TimeGenerated, created_by, ipaddress
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
event_type | eq |
| field:"event_type" kind:eq value:"workloads.update" |
new_mode | in |
| field:"new_mode" kind:in |
old_mode | in |
| field:"old_mode" kind:in |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
TimeGenerated | project |
created_by | project |
ipaddress | project |
new_mode | project |
old_mode | project |
workload_href | project |
workload_name | project |