NRT GravityZone Incident Alerts

Status: available
Severity: medium
Source: github.com/Azure/Azure-Sentinel

The query identifies incident-level events received from the GravityZone Data Connector

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1210` Exploitation of Remote Services

Rule body

id: 73c803aa-1188-45dd-8379-62a3319d3d9f
name: NRT GravityZone Incident Alerts
description: The query identifies incident-level events received from the GravityZone Data Connector
version: 1.0.0
kind: NRT
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: GravityZoneDataConnector
    dataTypes:
      - ASimAlertEventBitdefenderGravityZone
tactics:
  - LateralMovement
relevantTechniques:
  - T1210
query: |
  ASimAlertEventBitdefenderGravityZone(pack=true)
    | extend IncidentType = case(
        AdditionalFields.Module == "new-incident", "EDR Incident",
        AdditionalFields.Module == "new-extended-incident", "XDR Incident",
        AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
        AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
        AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
        "Incident"   // fallback value if null or unmatched
      ),
      Tactics = AdditionalFields.AttackTypes
    | project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN
eventGroupingSettings:
  aggregationKind: AlertPerResult
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DvcHostname
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: DvcIpAddr
alertDetailsOverride:
  alertSeverityColumnName: EventSeverity
  alertDisplayNameFormat: 'GravityZone: {{IncidentType}}'
  alertDescriptionFormat: |
    Alert generated on {{EventStartTime}} in Bitdefender GravityZone.\n\nGravityZone Incident ID / Alert GUID: {{EventUid}}\n\nPlease check the source for more information and investigate further.
  alertTacticsColumnName: Tactics
  alertDynamicProperties:
    - alertProperty: ProductName
      value: EventProduct
    - alertProperty: ProviderName
      value: EventVendor

Stages and Predicates

Stage 1: `source`

ASimAlertEventBitdefenderGravityZone(pack=true)

Stage 2: `extend`

| extend IncidentType = case(
      AdditionalFields.Module == "new-incident", "EDR Incident",
      AdditionalFields.Module == "new-extended-incident", "XDR Incident",
      AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
      AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
      AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
      "Incident"
    ),
    Tactics = AdditionalFields.AttackTypes

IncidentType =

ifModule == "new-incident""EDR Incident"

elifModule == "new-extended-incident""XDR Incident"

elifModule == "ransomware-mitigation""Ransomware Mitigation"

elifModule == "network-sandboxing""Sandbox Analyzer Detection"

elifModule == "exchange-malware""Exchange Malware Detection"

else"Incident"

Stage 3: `project`

| project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN

Output fields

These fields are emitted when the rule matches.

Field	Source
`DvcAction`	`project`
`DvcFQDN`	`project`
`DvcHostname`	`project`
`DvcId`	`project`
`DvcIpAddr`	`project`
`EventProduct`	`project`
`EventSeverity`	`project`
`EventStartTime`	`project`
`EventUid`	`project`
`EventVendor`	`project`
`IncidentType`	`project`
`Tactics`	`project`