Illumio Firewall Tampering Analytic Rule

id: e9e4e466-3970-4165-bc8d-7721c6ef34a6
name: Illumio Firewall Tampering Analytic Rule
description: |
  'Create Microsoft Sentinel Incident When Firewall Is Tampered With'
severity: Medium
status: Available
requiredDataConnectors: 
  - connectorId: IllumioSaaSDataConnector
    dataTypes:
      - Illumio_Auditable_Events_CL
  - connectorId: SyslogAma
    datatypes:
      - Syslog      
queryFrequency: 60m
queryPeriod: 60m
triggerOperator: gt
triggerThreshold: 0
tactics:
- DefenseEvasion
relevantTechniques:
- T1562
query: |
 Illumio_Auditable_Events_CL
  | union IllumioSyslogAuditEvents 
  | where event_type has 'tampering'
  | extend ipaddress = action.src_ip,
            hostname = created_by.agent.hostname,
            ven_href = created_by.ven.href
  | project-away resource_changes, action, version
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: hostname
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ipaddress          
alertDetailsOverride:
  alertDisplayNameFormat: | 
    Illumio Firewall Tamper Incident for {{hostname}}
  alertDescriptionFormat: | 
    Illumio Firewall Tamper Incident for {{hostname}} generated at {{TimeGenerated}}
version: 1.0.7
kind: Scheduled