Recorded Future Sandbox - Malicious File in Storage Account

id: a1b2c3d4-5678-90ab-cdef-333333333333
name: Recorded Future Sandbox - Malicious File in Storage Account
description: |
  'Creates incidents when Recorded Future Sandbox detects malicious files from Azure Storage Account'
severity: Medium
status: Available
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
query: |
  RecordedFutureSandboxResults_CL
  | where TimeGenerated >= now(-1h)
  | where Source_s == "StorageAccount"
  | where toint(SandboxScore_s) >= 50
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Malicious File in Storage: {{FileName_s}}'
  alertDescriptionFormat: |
    _Recorded Future Sandbox - Malicious File in Storage Account_

    **Sandbox Score:** {{SandboxScore_s}}/100

    **Verdict:** {{SandboxVerdict_s}}

    **Sample ID:** {{SampleId_s}}

    A malicious file was detected in an Azure Storage Account. Investigate the source of this file and review the full sandbox report.
customDetails:
  RFLabel: SourceSystem
  Source: Source_s
  SandboxScore: SandboxScore_s
  SandboxVerdict: SandboxVerdict_s
  FileName: FileName_s
  SampleId: SampleId_s
entityMappings:
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: FileName_s
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1h
    matchingMethod: Selected
    groupByCustomDetails:
      - SandboxVerdict
version: 1.0.0
kind: NRT