Analytics Auditoralerts
KQL detection rule by ep3p · MIT
This query can help you to filter certain security alerts depending on the auditor of the events. This function will need the list of auditors you want to filter, and the rule ids that generate the security alerts. Click "Save as function", in Parameters write in the fields: "dynamic" "rule_auditors" "dynamic([])" "dynamic" "monitored_rule_ids" "dynamic([])" If you name the function "AuditorAlerts", you can check the function with queries like the following: AuditorAlerts(dynamic(["SOC", "Security Architecture"]), dynamic(["00000000-0000-0000-0000-000000000000","00000000-0000-0000-0000-000000000001"])) let Function = (rule_auditors:dynamic = dynamic([]), monitored_rule_ids:dynamic = dynamic([])){
// This query can help you to filter certain security alerts depending on the auditor of the events.
// This function will need the list of auditors you want to filter, and the rule ids that generate the security alerts.
//
// Click "Save as function", in Parameters write in the fields:
// "dynamic" "rule_auditors" "dynamic([])"
// "dynamic" "monitored_rule_ids" "dynamic([])"
//
// If you name the function "AuditorAlerts", you can check the function with queries like the following:
//
// AuditorAlerts(dynamic(["SOC", "Security Architecture"]), dynamic(["00000000-0000-0000-0000-000000000000","00000000-0000-0000-0000-000000000001"]))
//
//let Function = (rule_auditors:dynamic = dynamic([]), monitored_rule_ids:dynamic = dynamic([])){
SecurityAlert
| where AlertType has_any (monitored_rule_ids)
| project
AlertName,
AlertSeverity,
AlertDescription = Description,
Tactics,
Entities,
ExtractedEvents = set_union(extract_all(@"\'([^\']+)\'", dynamic([1]), tostring(todynamic(ExtendedProperties).Query)), dynamic([]))
| mv-expand ExtractedEvents to typeof(string)
| extend BagToUnpack = todynamic(zlib_decompress_from_base64_string(ExtractedEvents))
| evaluate bag_unpack(BagToUnpack, columnsConflict="replace_source")
| extend Auditors = column_ifexists("Auditors", "")
| mv-expand Auditor = split(Auditors, " & ") to typeof(string)
| where Auditor in (rule_auditors)
| extend AlertName = replace_string(AlertName, "monitored", strcat(iff(isnotempty(Auditor), strcat(Auditor, " "), ""), "monitored"))
| project-away ExtractedEvents
| extend
TimeGenerated = column_ifexists("TimeGenerated", datetime(null)),
Activity = column_ifexists("Activity", ""),
ActorAccount = column_ifexists("ActorAccount", ""),
ActorSid = column_ifexists("ActorSid", ""),
ActorAccountSid = column_ifexists("ActorAccountSid", ""),
ActorAccountType = column_ifexists("ActorAccountType", ""),
ActorDomainName = column_ifexists("ActorDomainName", ""),
GroupName = column_ifexists("GroupName", ""),
GroupSid = column_ifexists("GroupSid", ""),
MemberAccount = column_ifexists("MemberAccount", ""),
MemberSid = column_ifexists("MemberSid", ""),
Computer = column_ifexists("Computer", ""),
EventData = column_ifexists("EventData", ""),
AttributeValue_EventData = column_ifexists("AttributeValue_EventData", ""),
AttributeLDAPDisplayName = column_ifexists("AttributeLDAPDisplayName", ""),
OperationTypeTranslated = column_ifexists("OperationTypeTranslated", ""),
ModifiedAttributeValue = column_ifexists("ModifiedAttributeValue", ""),
UserIdentityAccountName = column_ifexists("UserIdentityAccountName", ""),
UserIdentityAccountId = column_ifexists("UserIdentityAccountId", ""),
Identity = column_ifexists("Identity", ""),
RequestedRole = column_ifexists("RequestedRole", "")
| project-reorder
TimeGenerated
//};
//Function(rule_auditors, monitored_rule_ids)