Detection rules › Kusto
SSG_Security_Incidents
The security analytic rule is designed to scrutinize network activity involving private IP addresses within an organization's internal network. By filtering log entries to include only those where either the source or the destination IP is private, the rule focuses on internal communications that could indicate unauthorized access, internal threats, or other security anomalies.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1486 Data Encrypted for Impact |
Rule body kusto
id: d41fa731-45a2-4b23-bb1d-29896fbc5298
name: SSG_Security_Incidents
version: 1.0.0
kind: NRT
description: The security analytic rule is designed to scrutinize network activity involving private IP addresses within an organization's internal network. By filtering log entries to include only those where either the source or the destination IP is private, the rule focuses on internal communications that could indicate unauthorized access, internal threats, or other security anomalies.
severity: HIGH
tactics:
- Impact
relevantTechniques:
- T1486
query: |
SINECSecurityGuard_CL
| where ipv4_is_private(source_ip) or ipv4_is_private(destination_ip)
| project source_ip, destination_ip, signature_id, signature_name
suppressionEnabled: false
eventGroupingSettings:
aggregationKind: AlertPerResult
suppressionDuration: 5h
alertDetailsOverride:
alertDisplayNameFormat: '{{signature_name}} '
alertDescriptionFormat: 'Alert {{signature_name}} generated from {{source_ip}} to {{destination_ip}} '
alertDynamicProperties: []
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 5m
matchingMethod: AnyAlert
groupByEntities:
- IP
groupByAlertDetails: []
groupByCustomDetails:
- Source_IP
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: source_ip
- entityType: IP
fieldMappings:
- identifier: Address
columnName: destination_ip
customDetails:
Source_IP: source_ip
Stages and Predicates
Stage 1: source
SINECSecurityGuard_CL
Stage 2: where
| where ipv4_is_private(source_ip) or ipv4_is_private(destination_ip)
Stage 3: project
| project source_ip, destination_ip, signature_id, signature_name
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
destination_ip | cidr_match |
|
source_ip | cidr_match |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
destination_ip | project |
signature_id | project |
signature_name | project |
source_ip | project |