No traffic on Sensor Detected (Microsoft Defender for IoT)

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'This alert leverages Defender for IoT to detect that a sensor can no longer detect the network traffic, which indicates that the system is potentially insecure.'

MITRE ATT&CK coverage

Tactic	Techniques
Inhibit Response Function	`T0881` Service Stop

Rule body

id: 208c3f5b-3ba2-49b5-9bca-c44e58cd5fd3
name: No traffic on Sensor Detected (Microsoft Defender for IoT)
description: |
  'This alert leverages Defender for IoT to detect that a sensor can no longer detect the network traffic, which indicates that the system is potentially insecure.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: IoT
    dataTypes:
      - SecurityAlert (ASC for IoT)
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InhibitResponseFunction
relevantTechniques:
  - T0881
query: |
  SecurityAlert
  | where ProviderName == "IoTSecurity"
  | where AlertName == "No Traffic Detected on Sensor Interface" 
  | extend ExtendedProperties = parse_json(ExtendedProperties)
  | where tostring(ExtendedProperties.isNew) == "True"
  | extend DeviceId = tostring(ExtendedProperties.DeviceId), 
           SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
           DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
           RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
           Protocol = tostring(ExtendedProperties.Protocol), 
           AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
  | project
    TimeGenerated,
    DeviceId,
    ProductName,
    ProductComponentName,
    AlertSeverity,
    AlertName,
    Description,
    Protocol,
    SourceDeviceAddress,
    DestDeviceAddress,
    RemediationSteps,
    Tactics,
    Entities,
    VendorOriginalId,
    AlertLink,
    AlertManagementUri,
    Techniques
entityMappings:
sentinelEntitiesMappings:
  - columnName: Entities
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  Sensor: DeviceId
  Protocol: Protocol
  VendorOriginalId: VendorOriginalId
  AlertManagementUri: AlertManagementUri
alertDetailsOverride:
  alertDisplayNameFormat: (MDIoT) {{AlertName}}
  alertDescriptionFormat: (MDIoT) {{Description}}
  alertTacticsColumnName: Tactics
  alertSeverityColumnName: AlertSeverity
  alertDynamicProperties: 
    - alertProperty: ProductName
      value: ProductName
    - alertProperty: RemediationSteps
      value: RemediationSteps
    - alertProperty: Techniques
      value: Techniques
    - alertProperty: ProductComponentName
      value: ProductComponentName
    - alertProperty: AlertLink
      value: AlertLink
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SecurityAlert

Stage 2: `where`

| where ProviderName == "IoTSecurity"

Stage 3: `where`

| where AlertName == "No Traffic Detected on Sensor Interface"

Stage 4: `extend`

| extend ExtendedProperties = parse_json(ExtendedProperties)

Stage 5: `where`

| where tostring(ExtendedProperties.isNew) == "True"

Stage 6: `extend`

| extend DeviceId = tostring(ExtendedProperties.DeviceId), 
         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
         Protocol = tostring(ExtendedProperties.Protocol), 
         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)

Stage 7: `project`

| project
  TimeGenerated,
  DeviceId,
  ProductName,
  ProductComponentName,
  AlertSeverity,
  AlertName,
  Description,
  Protocol,
  SourceDeviceAddress,
  DestDeviceAddress,
  RemediationSteps,
  Tactics,
  Entities,
  VendorOriginalId,
  AlertLink,
  AlertManagementUri,
  Techniques

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AlertName`	eq	`No Traffic Detected on Sensor Interface`	`field:"AlertName" kind:eq value:"No Traffic Detected on Sensor Interface"`
`ProviderName`	eq	`IoTSecurity`	`field:"ProviderName" kind:eq value:"IoTSecurity"`
`isNew`	eq	`True` transforms: `tostring`	`field:"isNew" kind:eq value:"True"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AlertLink`	`project`
`AlertManagementUri`	`project`
`AlertName`	`project`
`AlertSeverity`	`project`
`Description`	`project`
`DestDeviceAddress`	`project`
`DeviceId`	`project`
`Entities`	`project`
`ProductComponentName`	`project`
`ProductName`	`project`
`Protocol`	`project`
`RemediationSteps`	`project`
`SourceDeviceAddress`	`project`
`Tactics`	`project`
`Techniques`	`project`
`TimeGenerated`	`project`
`VendorOriginalId`	`project`

No traffic on Sensor Detected (Microsoft Defender for IoT)

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: where

Stage 6: extend

Stage 7: project