-
Notifications
You must be signed in to change notification settings - Fork 4.9k
/
GetAlertRuleTemplateById.json
80 lines (80 loc) · 3.37 KB
/
GetAlertRuleTemplateById.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
{
"parameters": {
"api-version": "2021-10-01",
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
"resourceGroupName": "myRg",
"workspaceName": "myWorkspace",
"operationalInsightsResourceProvider": "Microsoft.OperationalInsights",
"alertRuleTemplateId": "65360bb0-8986-4ade-a89d-af3cf44d28aa"
},
"responses": {
"200": {
"body": {
"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/alertRuleTemplates/65360bb0-8986-4ade-a89d-af3cf44d28aa",
"name": "65360bb0-8986-4ade-a89d-af3cf44d28aa",
"type": "Microsoft.SecurityInsights/AlertRuleTemplates",
"kind": "Scheduled",
"properties": {
"severity": "Low",
"query": "let timeframe = 1d;\nAWSCloudTrail\n| where TimeGenerated >= ago(timeframe)\n| where EventName == \"CreateNetworkAclEntry\"\n or EventName == \"CreateRoute\"\n| project TimeGenerated, EventName, EventTypeName, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent, UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements\n| extend AccountCustomEntity = UserIdentityUserName, IPCustomEntity = SourceIpAddress",
"queryFrequency": "P1D",
"queryPeriod": "P1D",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"displayName": "Changes to Amazon VPC settings",
"description": "This alert monitors changes to Amazon VPC (Virtual Private Cloud) settings such as new ACL entries and routes in route tables.\nMore information: https://medium.com/@GorillaStack/the-most-important-aws-cloudtrail-security-events-to-track-a5b9873f8255 \nand https://aws.amazon.com/vpc/",
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"tactics": [
"PrivilegeEscalation",
"LateralMovement"
],
"lastUpdatedDateUTC": "2021-02-27T10:00:00Z",
"createdDateUTC": "2019-02-27T00:00:00Z",
"status": "Available",
"version": "1.0.2",
"requiredDataConnectors": [
{
"connectorId": "AWS",
"dataTypes": [
"AWSCloudTrail"
]
}
],
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"identifier": "FullName",
"columnName": "AccountCustomEntity"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"identifier": "Address",
"columnName": "IPCustomEntity"
}
]
}
],
"customDetails": {
"EventNames": "EventName",
"EventTypes": "EventTypeName"
},
"alertDetailsOverride": {
"alertDisplayNameFormat": "Alert on event {{EventName}}",
"alertDescriptionFormat": "Suspicious activity was made by {{AccountCustomEntity}}",
"alertTacticsColumnName": null,
"alertSeverityColumnName": null
},
"alertRulesCreatedByTemplateCount": 0
}
}
}
}
}