Cortex XDR Incident - High

Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'A new incident was created in the Cortex XDR portal with a severity "High". Click on the events for incident details. '

Rule body

id: 06263265-ff65-43ff-8b15-6ac82325a672
name: Cortex XDR Incident - High
description: |
  'A new incident was created in the Cortex XDR portal with a severity "High". Click on the events for incident details. '
severity: High
requiredDataConnectors:
  - connectorId: CortexXDRDataConnector
    dataTypes:
      - PaloAltoCortexXDR_Incidents_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics: []
relevantTechniques: []
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: SingleAlert
alertDetailsOverride: null
customDetails: null
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: Users_s
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: XdrUrl
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Hosts_s
sentinelEntitiesMappings: null
query: |
  PaloAltoCortexXDR_Incidents
  | where Severity contains "high"
  | where Status !contains "resolved_auto"
  // the below line filters for incidents that has at least one user or one host in it. Comment the below line if you want to generated incidents that have 0 user or 0 host as well
  | where HostCount > 0 or UserCount > 0
  | extend Hosts_s = tostring(Hosts), Users_s = tostring(Users)
  | project TimeGenerated, IncidentId, Status, Severity, IncidentSources, Description, XdrUrl, Hosts_s, Users_s, AlertCategories, HostCount, UserCount, AlertCount, CreationTime, ModificationTime
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

PaloAltoCortexXDR_Incidents

Stage 2: `where`

| where Severity contains "high"

Stage 3: `where`

| where Status !contains "resolved_auto"

Stage 4: `where`

| where HostCount > 0 or UserCount > 0

Stage 5: `extend`

| extend Hosts_s = tostring(Hosts), Users_s = tostring(Users)

Stage 6: `project`

| project TimeGenerated, IncidentId, Status, Severity, IncidentSources, Description, XdrUrl, Hosts_s, Users_s, AlertCategories, HostCount, UserCount, AlertCount, CreationTime, ModificationTime

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Status`	contains	`resolved_auto`	`excludes:Status` `field:"Status" value:"resolved_auto"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`HostCount`	gt	`0`	`field:"HostCount" kind:gt value:"0"`
`Severity`	contains	`high`	`field:"Severity" kind:contains value:"high"`
`UserCount`	gt	`0`	`field:"UserCount" kind:gt value:"0"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AlertCategories`	`project`
`AlertCount`	`project`
`CreationTime`	`project`
`Description`	`project`
`HostCount`	`project`
`Hosts_s`	`project`
`IncidentId`	`project`
`IncidentSources`	`project`
`ModificationTime`	`project`
`Severity`	`project`
`Status`	`project`
`TimeGenerated`	`project`
`UserCount`	`project`
`Users_s`	`project`
`XdrUrl`	`project`

Cortex XDR Incident - High

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: extend

Stage 6: project