Detection rules › Kusto

Tanium Threat Response Alerts

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Severity
high
Time window
6m
Source
github.com/Azure/Azure-Sentinel

Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook

Rule body kusto

id: dd9aa0ff-7ac1-4448-879c-e1a18d5890b4
name: Tanium Threat Response Alerts
description: 'Alerts from Tanium Threat Response (THR) that can be acted upon by Microsoft Sentinel Playbook'
severity: High
queryFrequency: 5m
queryPeriod: 6m
triggerOperator: gt
triggerThreshold: 0
tactics: []
relevantTechniques: []
requiredDataConnectors: []
query: |
  let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1))  };
  TaniumThreatResponse_CL
  | extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)
  | extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))
  | where Computer_IP_s !contains "N/A"
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: TaniumUrl
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: Computer_IP_s
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Computer_Name_s
  - entityType: Malware
    fieldMappings:
      - identifier: Name
        columnName: TaniumTHRLabel
customDetails:
  IntelId: Intel_Id_d
  TaniumAlertId: Alert_Id_g
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: "{{TaniumTHRLabel}}"
  alertDescriptionFormat: "Alert from Tanium Threat Response. GUID: {{Alert_Id_g}}; Computer Name: {{Computer_Name_s}}; IP: {{Computer_IP_s}}"
version: 1.2.0
kind: Scheduled

Stages and Predicates

Parameters

let cap = (s:string) { strcat(toupper(substring(s,0,1)), substring(s,1))  };

Stage 1: source

TaniumThreatResponse_CL

Stage 2: extend

| extend TaniumUrl = pack("computer_name", Computer_Name_s, "alert_guid", Alert_Id_g, "ip_address", Computer_IP_s, "platform", Match_Details_finding_system_info_platform_s)

Stage 3: extend

| extend TaniumTHRLabel = strcat(cap(Intel_Type_s)," - ", cap(Intel_Name_s), " - ", cap(Match_Details_match_type_s))

Stage 4: where

| where Computer_IP_s !contains "N/A"

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Computer_IP_scontainsN/A

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
TaniumUrlextend
TaniumTHRLabelextend