detection.wiki

Detection rules › Kusto

Jamf Protect - Network Threats

Status
available
Severity
informational
Source
github.com/Azure/Azure-Sentinel

'Creates an incident based based on Jamf Protect's Network Threat Event Stream alerts.'

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1133 External Remote Services

Rule body kusto

id: 44da53c3-f3b0-4b70-afff-f79275cb9442
name: Jamf Protect - Network Threats
description: |
  'Creates an incident based based on Jamf Protect's Network Threat Event Stream alerts.'
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: JamfProtect
    dataTypes: 
      - jamfprotect_CL
suppressionDuration: PT5H
suppressionEnabled: false
tactics:
  - InitialAccess
relevantTechniques:
  - T1133
query: |
  JamfProtectThreatEvents
  | where EventResult == "Blocked"
      and isnotempty(EventSeverity)
  | extend Tactics = "Initial Access"
  | extend Techniques = "T1566"
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: "Network Threat detected on {{DvcHostname}}"
  alertDescriptionFormat: "A Network Threat has been {{EventResult}} on {{DvcHostname}}"
  alertTacticsColumnName: Tactics
  alertSeverityColumnName: EventSeverity
  alertDynamicProperties:
    - alertProperty: AlertLink
      value: EventReportUrl
    - alertProperty: ProviderName
      value: EventVendor
    - alertProperty: ProductName
      value: EventProduct
    - alertProperty: RemediationSteps
      value: EventResult
    - alertProperty: Techniques
      value: Techniques
customDetails:
  Category: ThreatCategory
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: Hostname
  - identifier: OSFamily
    columnName: DvcOs
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DstIpAddr
- entityType: Account
  fieldMappings:
  - identifier: AadUserId
    columnName: SrcUsermail
  - identifier: FullName
    columnName: SrcUsername
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: DnsQueryName
version: 1.0.5
kind: NRT

Stages and Predicates

Stage 1: source

JamfProtectThreatEvents

Stage 2: where

| where EventResult == "Blocked"
    and isnotempty(EventSeverity)

Stage 3: extend

| extend Tactics = "Initial Access"

Stage 4: extend

| extend Techniques = "T1566"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventResulteq
  • Blocked transforms: cased
EventSeverityis_not_null
  • (no value, null check)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
Tacticsextend
Techniquesextend