SSG_Security_Incidents

id: d41fa731-45a2-4b23-bb1d-29896fbc5298
name: SSG_Security_Incidents
version: 1.0.0
kind: NRT
description: The security analytic rule is designed to scrutinize network activity involving private IP addresses within an organization's internal network. By filtering log entries to include only those where either the source or the destination IP is private, the rule focuses on internal communications that could indicate unauthorized access, internal threats, or other security anomalies.
severity: HIGH
tactics:
  - Impact
relevantTechniques:
  - T1486
query: |
  SINECSecurityGuard_CL
  | where ipv4_is_private(source_ip) or ipv4_is_private(destination_ip)
  | project source_ip, destination_ip, signature_id, signature_name
suppressionEnabled: false
eventGroupingSettings:
  aggregationKind: AlertPerResult
suppressionDuration: 5h
alertDetailsOverride:
  alertDisplayNameFormat: '{{signature_name}} '
  alertDescriptionFormat: 'Alert {{signature_name}} generated from {{source_ip}} to {{destination_ip}} '
  alertDynamicProperties: []
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 5m
    matchingMethod: AnyAlert
    groupByEntities:
    - IP
    groupByAlertDetails: []
    groupByCustomDetails:
    - Source_IP
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: source_ip
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: destination_ip
customDetails:
  Source_IP: source_ip