Detection rules › Kusto
SOCRadar Alarm Volume Spike
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
'Detects unusual spikes in SOCRadar alarm volume that may indicate an active campaign, coordinated attack, or data breach. Triggers when alarm count in the last hour exceeds the 7-day hourly average by more than 3x.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration | T1567 Exfiltration Over Web Service |
| Impact | T1485 Data Destruction |
Rule body kusto
id: 4a7b3c9e-2d15-4e8f-b6a3-9c2e7d5a1b4f
name: SOCRadar Alarm Volume Spike
description: |
'Detects unusual spikes in SOCRadar alarm volume that may indicate an active campaign, coordinated attack, or data breach. Triggers when alarm count in the last hour exceeds the 7-day hourly average by more than 3x.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1h
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
- Exfiltration
relevantTechniques:
- T1485
- T1567
query: |
let baseline = SOCRadar_Alarms_CL
| where TimeGenerated > ago(7d) and TimeGenerated < ago(1h)
| summarize AvgHourly = count() / 168.0;
let recent = SOCRadar_Alarms_CL
| where TimeGenerated > ago(1h)
| summarize RecentCount = count() by AlarmMainType;
recent
| extend BaselineAvg = toscalar(baseline)
| where RecentCount > (BaselineAvg * 3) and RecentCount > 5
| extend SpikeRatio = round(RecentCount / BaselineAvg, 2)
| extend timestamp = now()
| extend AccountName = AlarmMainType
entityMappings:
- entityType: Malware
fieldMappings:
- identifier: Name
columnName: AccountName
version: 1.0.0
kind: Scheduled
Stages and Predicates
Let binding: baseline
let baseline = SOCRadar_Alarms_CL
| where TimeGenerated > ago(7d) and TimeGenerated < ago(1h)
| summarize AvgHourly = count() / 168.0;
The stages below define let recent (the rule's main pipeline source).
Stage 1: source
SOCRadar_Alarms_CL
Stage 2: where
| where TimeGenerated > ago(1h)
Stage 3: summarize
| summarize RecentCount = count() by AlarmMainType
The stages below run on recent (the outer pipeline).
Stage 4: extend
recent
| extend BaselineAvg = toscalar(baseline)
References baseline (defined above).
Stage 5: where
| where RecentCount > (BaselineAvg * 3) and RecentCount > 5
Stage 6: extend (3 consecutive steps)
| extend SpikeRatio = round(RecentCount / BaselineAvg, 2)
| extend timestamp = now()
| extend AccountName = AlarmMainType
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
RecentCount | cross_field_compare |
|
RecentCount | gt |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
AlarmMainType | summarize |
RecentCount | summarize |
BaselineAvg | extend |
SpikeRatio | extend |
timestamp | extend |
AccountName | extend |