Rubrik Threat Monitoring

Status: available
Severity: medium
Time window: 10m
Group by: count_, custom_details_objectId_g, eventname
Source: github.com/Azure/Azure-Sentinel

'Rubrik Threat Monitoring matches Event Name and if match found then generate the incident for each object.'

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1546` Event Triggered Execution

Rule body

id: 0083cbc4-776e-42ca-8694-6950fd605df9
name: Rubrik Threat Monitoring
version: 1.0.0
kind: Scheduled
description: |
  'Rubrik Threat Monitoring matches Event Name and if match found then generate the incident for each object.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: RubrikSecurityCloudAzureFunctions
    dataTypes: 
      - RubrikEventsData
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics: 
  - Persistence
relevantTechniques:
  - T1546
query: |
       Rubrik_Events_Data_CL
       | where custom_details_eventName_s endswith "AnalysisMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringHashCatalogAnalysisFailed" or custom_details_eventName_s contains "ThreatMonitoringHashMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringYaraMatchesFound"
       | extend hashMatchCount = toint(extract("Found ([0-9]+) hash matches",1, summary_s)),    yaraMatchCount = toint(extract("Found ([0-9]+) YARA rule matches", 1, summary_s)),    fileHashMatchCount = toint(extract("Found file hash matches for ([0-9]+) files", 1, summary_s))
       | extend count_ = coalesce(hashMatchCount,yaraMatchCount, fileHashMatchCount), eventname = substring(custom_details_eventName_s,16, strlen(custom_details_eventName_s) - 28)
       | where count_ > 0
       | summarize arg_max(TimeGenerated,*) by eventname, custom_details_objectId_g, count_
incidentConfiguration:
      createIncident: true
      groupingConfiguration:
        enabled: true
        reopenClosedIncident: false
        lookbackDuration: P7D
        matchingMethod: Selected
        groupByCustomDetails:
        - ObjectName
        - ObjectId
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: ThreatMonitoring Found {{count_}} {{eventname}} Matches for {{custom_details_objectName_s}}
customDetails:
  EventName: custom_details_eventName_s
  Summary: summary_s
  ClusterIdentifier: custom_details_clusterId_g
  ObjectId: custom_details_objectId_g
  ObjectName: custom_details_objectName_s
  ObjectType: custom_details_objectType_s
  Url: custom_details_url_s

Stages and Predicates

Stage 1: `source`

Rubrik_Events_Data_CL

Stage 2: `where`

| where custom_details_eventName_s endswith "AnalysisMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringHashCatalogAnalysisFailed" or custom_details_eventName_s contains "ThreatMonitoringHashMatchesFound" or custom_details_eventName_s contains "ThreatMonitoringYaraMatchesFound"

Stage 3: `extend`

| extend hashMatchCount = toint(extract("Found ([0-9]+) hash matches",1, summary_s)),    yaraMatchCount = toint(extract("Found ([0-9]+) YARA rule matches", 1, summary_s)),    fileHashMatchCount = toint(extract("Found file hash matches for ([0-9]+) files", 1, summary_s))

Stage 4: `extend`

| extend count_ = coalesce(hashMatchCount,yaraMatchCount, fileHashMatchCount), eventname = substring(custom_details_eventName_s,16, strlen(custom_details_eventName_s) - 28)

Stage 5: `where`

| where count_ > 0

Stage 6: `summarize`

| summarize arg_max(TimeGenerated,*) by eventname, custom_details_objectId_g, count_

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`count_`	gt	`0`	`field:"count_" kind:gt value:"0"`
`custom_details_eventName_s`	contains	`ThreatMonitoringHashCatalogAnalysisFailed` `ThreatMonitoringHashMatchesFound` `ThreatMonitoringYaraMatchesFound`	`field:"custom_details_eventName_s" kind:contains`
`custom_details_eventName_s`	ends_with	`AnalysisMatchesFound`	`field:"custom_details_eventName_s" kind:ends_with value:"AnalysisMatchesFound"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`count_`	`summarize`
`custom_details_objectId_g`	`summarize`
`eventname`	`summarize`

Rubrik Threat Monitoring

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: where

Stage 6: summarize