detection.wiki

Detection rules › Kusto

Guardian- Not Safe For Work Policy Violation Detection

Status
available
Severity
low
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'This alert creates an incident when Not Safe For Work Policy Violation detected from the Guardian.'

Rule body

id: f472bd5e-ffb3-4c8e-8abd-97aaa8ebcdff
name: Guardian- Not Safe For Work Policy Violation Detection
description: |
  'This alert creates an incident when Not Safe For Work Policy Violation detected from the Guardian.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: BoschAIShield
    dataTypes:
      - Guardian
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'Not Safe For Work'
  | where Severity =~ 'Low'
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: HostName
      - identifier: NTDomain
        columnName: NTDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride:
  alertDisplayNameFormat: Guardian- Not Safe For Work Policy Violation detection
  alertDescriptionFormat: |
    This query detects Not Safe For Work Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
  alertTacticsColumnName: null
  alertSeverityColumnName: Severity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

Guardian

Stage 2: where

| where PolicyViolatedControlFeature =~ 'Not Safe For Work'

Stage 3: where

| where Severity =~ 'Low'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
PolicyViolatedControlFeatureeq
  • Not Safe For Work
field:"PolicyViolatedControlFeature" kind:eq value:"Not Safe For Work"
Severityeq
  • Low
field:"Severity" kind:eq value:"Low"