Detection rules › Kusto
NetworkSecurityGroups Alert From Prancer
'High severity network security groups alerts found by Prancer.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance |
Rule body
id: a8babf91-b844-477c-8abf-d31e3df74933
name: NetworkSecurityGroups Alert From Prancer
description: |
'High severity network security groups alerts found by Prancer.'
severity: High
requiredDataConnectors:
- connectorId: PrancerLogData
dataTypes:
- prancer_CL
queryFrequency: 5h
queryPeriod: 5h
triggerOperator: gt
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: SingleAlert
status: Available
tactics:
- Reconnaissance
relevantTechniques:
- T1595
query: |
union prancer_CL
| where deviceProduct_s == 'azure'
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Network/networkSecurityGroups' //and parse_json(data_data_snapshots_s)[0].region != ''
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
| extend snapshot = parse_json(data_data_snapshots_s)
| mv-expand snapshot
| extend
id = tostring(snapshot.id),
structure = tostring(snapshot.structure),
reference = tostring(snapshot.reference),
source = tostring(snapshot.source),
collection = tostring(snapshot.collection),
type = tostring(snapshot.type),
region = tostring(snapshot.region),
resourceTypes = tostring(snapshot.resourceTypes),
path = tostring(snapshot.path)
customDetails:
entityMappings:
- entityType: AzureResource
fieldMappings:
- identifier: ResourceId
columnName: path
alertDetailsOverride:
alertDisplayNameFormat: "{{data_data_message_s}}"
alertDescriptionFormat: "{{data_data_description_s}}"
alertSeverityColumnName: "{{data_data_severity_s}}"
alertDynamicProperties:
- alertProperty: RemediationSteps
value: data_data_remediation_description_s
version: 1.0.2
kind: Scheduled
Stages and Predicates
Stage 1: union
union prancer_CL
Stage 2: source
prancer_CL
Stage 3: where
| where deviceProduct_s == 'azure'
Stage 4: where
| where parse_json(data_data_snapshots_s)[0].type == 'Microsoft.Network/networkSecurityGroups'
Stage 5: where
| where data_data_severity_s == 'High' and data_data_result_s == 'failed'
Stage 6: extend
| extend snapshot = parse_json(data_data_snapshots_s)
Stage 7: mv-expand
| mv-expand snapshot
Stage 8: extend
| extend
id = tostring(snapshot.id),
structure = tostring(snapshot.structure),
reference = tostring(snapshot.reference),
source = tostring(snapshot.source),
collection = tostring(snapshot.collection),
type = tostring(snapshot.type),
region = tostring(snapshot.region),
resourceTypes = tostring(snapshot.resourceTypes),
path = tostring(snapshot.path)
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
data_data_result_s | eq |
| field:"data_data_result_s" kind:eq value:"failed" |
data_data_severity_s | eq |
| field:"data_data_severity_s" kind:eq value:"High" |
deviceProduct_s | eq |
| field:"deviceProduct_s" kind:eq value:"azure" |
type | eq |
| field:"type" kind:eq value:"Microsoft.Network/networkSecurityGroups" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
snapshot | extend |
collection | extend |
id | extend |
path | extend |
reference | extend |
region | extend |
resourceTypes | extend |
source | extend |
structure | extend |
type | extend |