Detection rules › Kusto
Tanium Threat Response Alerts
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook
Rule body kusto
id: dd9aa0ff-7ac1-4448-879c-e1a18d5890b4
name: Tanium Threat Response Alerts
description: 'Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook'
severity: High
queryFrequency: 5m
queryPeriod: 6m
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
requiredDataConnectors: []
query: |
let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1)) };
TaniumThreatResponse_CL
| extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
| extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
| where Computer_IP_s !contains "N/A"
entityMappings:
- entityType: URL
fieldMappings:
- identifier: Url
columnName: TaniumUrl
- entityType: IP
fieldMappings:
- identifier: Address
columnName: Computer_IP_s
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: Computer_Name_s
- entityType: Malware
fieldMappings:
- identifier: Name
columnName: TaniumTHRLabel
customDetails:
IntelId: Intel_Id_d
TaniumAlertId: Alert_Id_g
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: false
reopenClosedIncident: false
lookbackDuration: PT5H
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: "{{TaniumTHRLabel}}"
alertDescriptionFormat: "Alert from Tanium Threat Response. GUID: {{Alert_Id_g}}; Computer Name: {{Computer_Name_s}}; IP: {{Computer_IP_s}}"
version: 1.2.0
kind: Scheduled
Stages and Predicates
Parameters
let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1)) };
Stage 1: source
TaniumThreatResponse_CL
Stage 2: extend
| extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
Stage 3: extend
| extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
Stage 4: where
| where Computer_IP_s !contains "N/A"
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Computer_IP_s | contains | N/A |
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
TaniumUrl | extend |
TaniumTHRLabel | extend |