M2131_AssetStoppedLogging

Status: available
Severity: medium
Time window: 14d
Group by: ResourceId
Source: github.com/Azure/Azure-Sentinel

'This alert is designed to monitor assets within the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when a monitored asset fails to provide a heartbeat within 24 hours.'

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1082` System Information Discovery

Rule body

id: 4be5b645-1d08-49e4-b58d-07294ff19223
name: M2131_AssetStoppedLogging
description: |
  'This alert is designed to monitor assets within the Maturity Model for Event Log Management (M-21-31) standard. The alert triggers when a monitored asset fails to provide a heartbeat within 24 hours.'
severity: Medium
status: Available 
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
relevantTechniques:
  - T1082
query: |
  let LastHeartbeatTime = Heartbeat
  | summarize LastHeartbeat_Time = arg_max(TimeGenerated, *) by ResourceId;
  Heartbeat
  | where TimeGenerated > ago(14d)
  | summarize LastHeartbeat_Hours = datetime_diff("hour",now(), max(TimeGenerated)) by ResourceId
  | where ResourceId <> ""
  | where ResourceId <> "None"
  | join kind=inner (LastHeartbeatTime) on ResourceId
  | where LastHeartbeat_Hours > 24
  | project LastHeartbeat_Hours, LastHeartbeat_Time, Computer, ComputerIP, Category, OSType, OSName, ResourceId, SubscriptionId, ResourceGroup, RemoteIPCountry 
  | sort by LastHeartbeat_Hours desc
entityMappings:
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: ResourceId
version: 1.0.0
kind: Scheduled

Stages and Predicates

Let binding: `LastHeartbeatTime` used in Stage 6

let LastHeartbeatTime = Heartbeat
| summarize LastHeartbeat_Time = arg_max(TimeGenerated, *) by ResourceId;

Stage 1: `source`

Heartbeat

Stage 2: `where`

| where TimeGenerated > ago(14d)

Stage 3: `summarize`

| summarize LastHeartbeat_Hours = datetime_diff("hour",now(), max(TimeGenerated)) by ResourceId

Stage 4: `where`

| where ResourceId <> ""

Stage 5: `where`

| where ResourceId <> "None"

Stage 6: `join`

| join kind=inner (LastHeartbeatTime) on ResourceId

Stage 7: `where`

| where LastHeartbeat_Hours > 24

Stage 8: `project`

| project LastHeartbeat_Hours, LastHeartbeat_Time, Computer, ComputerIP, Category, OSType, OSName, ResourceId, SubscriptionId, ResourceGroup, RemoteIPCountry

Stage 9: `sort`

| sort by LastHeartbeat_Hours desc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`LastHeartbeat_Hours`	gt	`24`	`field:"LastHeartbeat_Hours" kind:gt value:"24"`
`ResourceId`	ne	`None`	`field:"ResourceId" kind:ne value:"None"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Category`	`project`
`Computer`	`project`
`ComputerIP`	`project`
`LastHeartbeat_Hours`	`project`
`LastHeartbeat_Time`	`project`
`OSName`	`project`
`OSType`	`project`
`RemoteIPCountry`	`project`
`ResourceGroup`	`project`
`ResourceId`	`project`
`SubscriptionId`	`project`

M2131_AssetStoppedLogging

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: LastHeartbeatTime used in Stage 6

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: where

Stage 5: where

Stage 6: join

Stage 7: where

Stage 8: project

Stage 9: sort