Detection rules › Kusto
NRT GravityZone Incident Alerts
The query identifies incident-level events received from the GravityZone Data Connector
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1210 Exploitation of Remote Services |
Rule body kusto
id: 73c803aa-1188-45dd-8379-62a3319d3d9f
name: NRT GravityZone Incident Alerts
description: The query identifies incident-level events received from the GravityZone Data Connector
version: 1.0.0
kind: NRT
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: GravityZoneDataConnector
dataTypes:
- ASimAlertEventBitdefenderGravityZone
tactics:
- LateralMovement
relevantTechniques:
- T1210
query: |
ASimAlertEventBitdefenderGravityZone(pack=true)
| extend IncidentType = case(
AdditionalFields.Module == "new-incident", "EDR Incident",
AdditionalFields.Module == "new-extended-incident", "XDR Incident",
AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
"Incident" // fallback value if null or unmatched
),
Tactics = AdditionalFields.AttackTypes
| project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: DvcHostname
- entityType: IP
fieldMappings:
- identifier: Address
columnName: DvcIpAddr
alertDetailsOverride:
alertSeverityColumnName: EventSeverity
alertDisplayNameFormat: 'GravityZone: {{IncidentType}}'
alertDescriptionFormat: |
Alert generated on {{EventStartTime}} in Bitdefender GravityZone.\n\nGravityZone Incident ID / Alert GUID: {{EventUid}}\n\nPlease check the source for more information and investigate further.
alertTacticsColumnName: Tactics
alertDynamicProperties:
- alertProperty: ProductName
value: EventProduct
- alertProperty: ProviderName
value: EventVendor
Stages and Predicates
Stage 1: source
ASimAlertEventBitdefenderGravityZone(pack=true)
Stage 2: extend
| extend IncidentType = case(
AdditionalFields.Module == "new-incident", "EDR Incident",
AdditionalFields.Module == "new-extended-incident", "XDR Incident",
AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
"Incident"
),
Tactics = AdditionalFields.AttackTypes
IncidentType =if
Module == "new-incident""EDR Incident"elif
Module == "new-extended-incident""XDR Incident"elif
Module == "ransomware-mitigation""Ransomware Mitigation"elif
Module == "network-sandboxing""Sandbox Analyzer Detection"elif
Module == "exchange-malware""Exchange Malware Detection"else
"Incident"Stage 3: project
| project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
DvcAction | project |
DvcFQDN | project |
DvcHostname | project |
DvcId | project |
DvcIpAddr | project |
EventProduct | project |
EventSeverity | project |
EventStartTime | project |
EventUid | project |
EventVendor | project |
IncidentType | project |
Tactics | project |