Detection rules › Kusto
SOCRadar High or Critical Severity Alarm
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
'Detects SOCRadar alarms with High or Critical severity levels that require immediate attention. These alarms typically indicate active threats such as credential exposure, ransomware mentions, or targeted attacks against the organization.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance | T1589 Gather Victim Identity Information |
| Initial Access | T1078 Valid Accounts |
Rule body kusto
id: 8f3e2c5a-7b91-4d6a-9e8f-1c4a2b5d7e3f
name: SOCRadar High or Critical Severity Alarm
description: |
'Detects SOCRadar alarms with High or Critical severity levels that require immediate attention. These alarms typically indicate active threats such as credential exposure, ransomware mentions, or targeted attacks against the organization.'
severity: High
status: Available
requiredDataConnectors: []
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Reconnaissance
- InitialAccess
relevantTechniques:
- T1589
- T1078
query: |
SOCRadar_Alarms_CL
| where Severity in ("High", "Critical")
| where Status == "OPEN"
| extend AlarmUrl = strcat("https://platform.socradar.com/company/", CompanyId, "/alarms/", AlarmId)
| extend AccountName = tostring(AlarmId)
| project TimeGenerated, AlarmId, Title, AlarmMainType, AlarmSubType, Severity, Status, AlarmUrl, AccountName
entityMappings:
- entityType: Malware
fieldMappings:
- identifier: Name
columnName: AlarmMainType
- identifier: Category
columnName: AlarmSubType
- entityType: URL
fieldMappings:
- identifier: Url
columnName: AlarmUrl
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
SOCRadar_Alarms_CL
Stage 2: where
| where Severity in ("High", "Critical")
Stage 3: where
| where Status == "OPEN"
Stage 4: extend
| extend AlarmUrl = strcat("https://platform.socradar.com/company/", CompanyId, "/alarms/", AlarmId)
Stage 5: extend
| extend AccountName = tostring(AlarmId)
Stage 6: project
| project TimeGenerated, AlarmId, Title, AlarmMainType, AlarmSubType, Severity, Status, AlarmUrl, AccountName
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
AccountName | project |
AlarmId | project |
AlarmMainType | project |
AlarmSubType | project |
AlarmUrl | project |
Severity | project |
Status | project |
TimeGenerated | project |
Title | project |