detection.wiki

Detection rules › Kusto

Radiflow - Policy Violation Detected

Status
available
Severity
medium
Time window
1h
Source
github.com/Azure/Azure-Sentinel

'Generates an incident when an unauthorized session or action is detected either by Radiflow's iSID.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Execution
Persistence
Evasion
Lateral Movement
Collection
Impair Process Control

Rule body

id: a3f4cc3e-2403-4570-8d21-1dedd5632958
name: Radiflow - Policy Violation Detected
description: |
  'Generates an incident when an unauthorized session or action is detected either by Radiflow's iSID.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: RadiflowIsid
    dataTypes:
      - RadiflowEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- LateralMovement
- ImpairProcessControl
- Execution
- Collection
- Persistence
relevantTechniques:
- T0886
- T0855
- T0858
- T0845
- T0889
- T0843
query: |
  RadiflowEvent
  | where DeviceProduct =~ 'iSID'
  | where EventClassID in (5, 156, 161, 169, 171, 182, 183, 184, 185)
  | extend EventMessage = iif(EventMessage == ' ', 'Policy Violation', EventMessage)
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: Policy Violation Detected
  alertDescriptionFormat: Recent activity which violates the security policy has been detected in the network. Please check the details for additional information.
  alertSeverityColumnName: EventSeverity
  alertDynamicProperties: []
suppressionEnabled: false
suppressionDuration: 5h
customDetails:
  SourceMAC: SourceMACAddress
  SourceType: SourceType
  SourceVendor: SourceVendor
  DestinationMAC: DestinationMACAddress
  DestinationType: DestinationType
  DestinationVendor: DestinationVendor
  Port: Port
  Protocol: Protocol
  SourceVLAN: SourceVLAN
  SourceHostName: SourceHostName
  SourceIP: SourceIP
  DestinationHostName: DestinationHostName
  DestinationIP: DestinationIP
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: NetBiosName
    columnName: SourceHostName
  - identifier: HostName
    columnName: SourceHostName
- entityType: Host
  fieldMappings:
  - identifier: NetBiosName
    columnName: DestinationHostName
  - identifier: HostName
    columnName: DestinationHostName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: DestinationIP
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: source

RadiflowEvent

Stage 2: where

| where DeviceProduct =~ 'iSID'

Stage 3: where

| where EventClassID in (5, 156, 161, 169, 171, 182, 183, 184, 185)

Stage 4: extend

| extend EventMessage = iif(EventMessage == ' ', 'Policy Violation', EventMessage)

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
DeviceProducteq
  • iSID
field:"DeviceProduct" kind:eq value:"iSID"
EventClassIDin
  • 156
  • 161
  • 169
  • 171
  • 182
  • 183
  • 184
  • 185
  • 5
field:"EventClassID" kind:in

Output fields

These fields are emitted when the rule matches.

FieldSource
EventMessageextend