SOCRadar Unsynced Closed Incident

Status: available
Severity: low
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

'Detects Microsoft Sentinel incidents tagged as SOCRadar that were closed more than 30 minutes ago but do not have the Synced tag. This may indicate the SOCRadar-Alarm-Sync playbook has failed to update the SOCRadar platform with the closure status.'

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1526` Cloud Service Discovery

Rule body

id: 6e2f8d4b-5a71-4c9e-b3f6-8a1c9d4e7b2a
name: SOCRadar Unsynced Closed Incident
description: |
  'Detects Microsoft Sentinel incidents tagged as SOCRadar that were closed more than 30 minutes ago but do not have the Synced tag. This may indicate the SOCRadar-Alarm-Sync playbook has failed to update the SOCRadar platform with the closure status.'
severity: Low
status: Available
requiredDataConnectors: []
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Discovery
relevantTechniques:
  - T1526
query: |
    SecurityIncident
    | where Labels has "SOCRadar"
    | where Status == "Closed"
    | where LastModifiedTime < ago(30m)
    | where not(Labels has "Synced")
    | extend AlarmId = extract(@"#(\d+)", 1, Title)
    | extend AccountName = AlarmId
    | project TimeGenerated, IncidentName, Title, Status, Classification, LastModifiedTime, AlarmId, AccountName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SecurityIncident

Stage 2: `where`

| where Labels has "SOCRadar"

Stage 3: `where`

| where Status == "Closed"

Stage 4: `where`

| where LastModifiedTime < ago(30m)

Stage 5: `where`

| where not(Labels has "Synced")

Stage 6: `extend`

| extend AlarmId = extract(@"#(\d+)", 1, Title)

Stage 7: `extend`

| extend AccountName = AlarmId

Stage 8: `project`

| project TimeGenerated, IncidentName, Title, Status, Classification, LastModifiedTime, AlarmId, AccountName

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Labels`	match	`Synced`	`excludes:Labels` `field:"Labels" value:"Synced"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Labels`	match	`SOCRadar` transforms: `term`	`field:"Labels" kind:match value:"SOCRadar"`
`Status`	eq	`Closed`	`field:"Status" kind:eq value:"Closed"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountName`	`project`
`AlarmId`	`project`
`Classification`	`project`
`IncidentName`	`project`
`LastModifiedTime`	`project`
`Status`	`project`
`TimeGenerated`	`project`
`Title`	`project`

SOCRadar Unsynced Closed Incident

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: extend

Stage 7: extend

Stage 8: project