Skip to content

Commit 59fa5dc

Browse files
anat-gilensonanat-gilenson
committed
New version for alert rules and updated examples - custom details, entity mappings and new incident grouping configuration
1 parent 2e84463 commit 59fa5dc

File tree

12 files changed

+555
-319
lines changed

12 files changed

+555
-319
lines changed

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/AlertRules.json‎

Lines changed: 322 additions & 273 deletions
Large diffs are not rendered by default.

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRuleTemplates/GetAlertRuleTemplateById.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRuleTemplates/GetAlertRuleTemplates.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/CreateFusionAlertRule.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/CreateMicrosoftSecurityIncidentCreationAlertRule.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/CreateScheduledAlertRule.json‎

Lines changed: 129 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",
@@ -10,15 +10,15 @@
1010
"kind": "Scheduled",
1111
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
1212
"properties": {
13-
"displayName": "Rule2",
14-
"description": "",
13+
"displayName": "My scheduled rule",
14+
"description": "An example for a scheduled rule",
1515
"severity": "High",
1616
"enabled": true,
1717
"tactics": [
1818
"Persistence",
1919
"LateralMovement"
2020
],
21-
"query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
21+
"query": "Heartbeat",
2222
"queryFrequency": "PT1H",
2323
"queryPeriod": "P2DT1H30M",
2424
"triggerOperator": "GreaterThan",
@@ -28,16 +28,50 @@
2828
"eventGroupingSettings": {
2929
"aggregationKind": "AlertPerResult"
3030
},
31+
"customDetails": {
32+
"OperatingSystemName": "OSName",
33+
"OperatingSystemType": "OSType"
34+
},
35+
"entityMappings": [
36+
{
37+
"entityType": "Host",
38+
"fieldMappings": [
39+
{
40+
"identifier": "FullName",
41+
"columnName": "Computer"
42+
}
43+
]
44+
},
45+
{
46+
"entityType": "IP",
47+
"fieldMappings": [
48+
{
49+
"identifier": "Address",
50+
"columnName": "ComputerIP"
51+
}
52+
]
53+
}
54+
],
55+
"alertDetailsOverride": {
56+
"alertDisplayNameFormat": "Alert from {{Computer}}",
57+
"alertDescriptionFormat": "Suspicious activity was made by {{ComputerIP}}"
58+
},
3159
"incidentConfiguration": {
3260
"createIncident": true,
3361
"groupingConfiguration": {
3462
"enabled": true,
3563
"reopenClosedIncident": false,
3664
"lookbackDuration": "PT5H",
37-
"entitiesMatchingMethod": "Custom",
65+
"matchingMethod": "Selected",
3866
"groupByEntities": [
39-
"Host",
40-
"Account"
67+
"Host"
68+
],
69+
"groupByAlertDetails": [
70+
"DisplayName"
71+
],
72+
"groupByCustomDetails": [
73+
"OperatingSystemType",
74+
"OperatingSystemName"
4175
]
4276
}
4377
}
@@ -51,38 +85,74 @@
5185
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
5286
"type": "Microsoft.SecurityInsights/alertRules",
5387
"kind": "Scheduled",
54-
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
88+
"etag": "\"01005144-0000-0d00-0000-6058632c0000\"",
5589
"properties": {
5690
"alertRuleTemplateName": null,
57-
"displayName": "Rule2",
58-
"description": "",
91+
"displayName": "My scheduled rule",
92+
"description": "An example for a scheduled rule",
5993
"severity": "High",
6094
"enabled": true,
6195
"tactics": [
6296
"Persistence",
6397
"LateralMovement"
6498
],
65-
"query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
99+
"query": "Heartbeat",
66100
"queryFrequency": "PT1H",
67101
"queryPeriod": "P2DT1H30M",
68102
"triggerOperator": "GreaterThan",
69103
"triggerThreshold": 0,
70104
"suppressionDuration": "PT1H",
71105
"suppressionEnabled": false,
72-
"lastModifiedUtc": "2019-01-01T13:15:30Z",
106+
"lastModifiedUtc": "2021-03-01T13:17:30Z",
73107
"eventGroupingSettings": {
74108
"aggregationKind": "AlertPerResult"
75109
},
110+
"customDetails": {
111+
"OperatingSystemName": "OSName",
112+
"OperatingSystemType": "OSType"
113+
},
114+
"entityMappings": [
115+
{
116+
"entityType": "Host",
117+
"fieldMappings": [
118+
{
119+
"identifier": "FullName",
120+
"columnName": "Computer"
121+
}
122+
]
123+
},
124+
{
125+
"entityType": "IP",
126+
"fieldMappings": [
127+
{
128+
"identifier": "Address",
129+
"columnName": "ComputerIP"
130+
}
131+
]
132+
}
133+
],
134+
"alertDetailsOverride": {
135+
"alertDisplayNameFormat": "Alert from {{Computer}}",
136+
"alertDescriptionFormat": "Suspicious activity was made by {{ComputerIP}}",
137+
"alertTacticsColumnName": null,
138+
"alertSeverityColumnName": null
139+
},
76140
"incidentConfiguration": {
77141
"createIncident": true,
78142
"groupingConfiguration": {
79143
"enabled": true,
80144
"reopenClosedIncident": false,
81145
"lookbackDuration": "PT5H",
82-
"entitiesMatchingMethod": "Custom",
146+
"matchingMethod": "Selected",
83147
"groupByEntities": [
84-
"Host",
85-
"Account"
148+
"Host"
149+
],
150+
"groupByAlertDetails": [
151+
"DisplayName"
152+
],
153+
"groupByCustomDetails": [
154+
"OperatingSystemType",
155+
"OperatingSystemName"
86156
]
87157
}
88158
}
@@ -95,35 +165,71 @@
95165
"name": "73e01a99-5cd7-4139-a149-9f2736ff2ab5",
96166
"type": "Microsoft.SecurityInsights/alertRules",
97167
"kind": "Scheduled",
98-
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
168+
"etag": "\"01007444-0000-0d00-0000-605863a70000\"",
99169
"properties": {
100170
"alertRuleTemplateName": null,
101-
"displayName": "Rule2",
102-
"description": "",
171+
"displayName": "My scheduled rule",
172+
"description": "An example for a scheduled rule",
103173
"severity": "High",
104174
"enabled": true,
105175
"tactics": [
106176
"Persistence",
107177
"LateralMovement"
108178
],
109-
"query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
179+
"query": "Heartbeat",
110180
"queryFrequency": "PT1H",
111181
"queryPeriod": "P2DT1H30M",
112182
"triggerOperator": "GreaterThan",
113183
"triggerThreshold": 0,
114184
"suppressionDuration": "PT1H",
115185
"suppressionEnabled": false,
116-
"lastModifiedUtc": "2019-01-01T13:15:30Z",
186+
"lastModifiedUtc": "2021-03-01T13:15:30Z",
187+
"customDetails": {
188+
"OperatingSystemName": "OSName",
189+
"OperatingSystemType": "OSType"
190+
},
191+
"entityMappings": [
192+
{
193+
"entityType": "Host",
194+
"fieldMappings": [
195+
{
196+
"identifier": "FullName",
197+
"columnName": "Computer"
198+
}
199+
]
200+
},
201+
{
202+
"entityType": "IP",
203+
"fieldMappings": [
204+
{
205+
"identifier": "Address",
206+
"columnName": "ComputerIP"
207+
}
208+
]
209+
}
210+
],
211+
"alertDetailsOverride": {
212+
"alertDisplayNameFormat": "Alert from {{Computer}}",
213+
"alertDescriptionFormat": "Suspicious activity was made by {{ComputerIP}}",
214+
"alertTacticsColumnName": null,
215+
"alertSeverityColumnName": null
216+
},
117217
"incidentConfiguration": {
118218
"createIncident": true,
119219
"groupingConfiguration": {
120220
"enabled": true,
121221
"reopenClosedIncident": false,
122222
"lookbackDuration": "PT5H",
123-
"entitiesMatchingMethod": "Custom",
223+
"matchingMethod": "Selected",
124224
"groupByEntities": [
125-
"Host",
126-
"Account"
225+
"Host"
226+
],
227+
"groupByAlertDetails": [
228+
"DisplayName"
229+
],
230+
"groupByCustomDetails": [
231+
"OperatingSystemType",
232+
"OperatingSystemName"
127233
]
128234
}
129235
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/DeleteAlertRule.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/GetAllAlertRules.json‎

Lines changed: 44 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",
@@ -18,35 +18,71 @@
1818
"etag": "\"0300bf09-0000-0000-0000-5c37296e0000\"",
1919
"properties": {
2020
"alertRuleTemplateName": null,
21-
"displayName": "Rule2",
22-
"description": "",
21+
"displayName": "My scheduled rule",
22+
"description": "An example for a scheduled rule",
2323
"severity": "High",
2424
"enabled": true,
2525
"tactics": [
2626
"Persistence",
2727
"LateralMovement"
2828
],
29-
"query": "ProtectionStatus | extend HostCustomEntity = Computer | extend IPCustomEntity = ComputerIP_Hidden",
29+
"query": "Heartbeat",
3030
"queryFrequency": "PT1H",
3131
"queryPeriod": "P2DT1H30M",
3232
"triggerOperator": "GreaterThan",
3333
"triggerThreshold": 0,
3434
"suppressionDuration": "PT1H",
3535
"suppressionEnabled": false,
36-
"lastModifiedUtc": "2019-01-01T13:15:30Z",
36+
"lastModifiedUtc": "2021-03-01T13:17:30Z",
3737
"eventGroupingSettings": {
3838
"aggregationKind": "AlertPerResult"
3939
},
40+
"customDetails": {
41+
"OperatingSystemName": "OSName",
42+
"OperatingSystemType": "OSType"
43+
},
44+
"entityMappings": [
45+
{
46+
"entityType": "Host",
47+
"fieldMappings": [
48+
{
49+
"identifier": "FullName",
50+
"columnName": "Computer"
51+
}
52+
]
53+
},
54+
{
55+
"entityType": "IP",
56+
"fieldMappings": [
57+
{
58+
"identifier": "Address",
59+
"columnName": "ComputerIP"
60+
}
61+
]
62+
}
63+
],
64+
"alertDetailsOverride": {
65+
"alertDisplayNameFormat": "Alert from {{Computer}}",
66+
"alertDescriptionFormat": "Suspicious activity was made by {{ComputerIP}}",
67+
"alertTacticsColumnName": null,
68+
"alertSeverityColumnName": null
69+
},
4070
"incidentConfiguration": {
4171
"createIncident": true,
4272
"groupingConfiguration": {
4373
"enabled": true,
4474
"reopenClosedIncident": false,
4575
"lookbackDuration": "PT5H",
46-
"entitiesMatchingMethod": "Custom",
76+
"matchingMethod": "Selected",
4777
"groupByEntities": [
48-
"Host",
49-
"Account"
78+
"Host"
79+
],
80+
"groupByAlertDetails": [
81+
"DisplayName"
82+
],
83+
"groupByCustomDetails": [
84+
"OperatingSystemType",
85+
"OperatingSystemName"
5086
]
5187
}
5288
}

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/GetFusionAlertRule.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",

‎specification/securityinsights/resource-manager/Microsoft.SecurityInsights/preview/2021-03-01-preview/examples/alertRules/GetMicrosoftSecurityIncidentCreationAlertRule.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"parameters": {
3-
"api-version": "2019-01-01-preview",
3+
"api-version": "2021-03-01-preview",
44
"subscriptionId": "d0cfe6b2-9ac0-4464-9919-dccaee2e48c0",
55
"resourceGroupName": "myRg",
66
"workspaceName": "myWorkspace",

0 commit comments

Comments
 (0)