Varonis - High severity alerts detected

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Identifies high-severity alerts generated by Varonis that indicate high-risk security events requiring immediate triage, investigation, and response.'

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1213` Data from Information Repositories `T1530` Data from Cloud Storage
Exfiltration	`T1567` Exfiltration Over Web Service

Rule body

id: 7d2c9a41-5b8e-4f36-9c1a-2e6b8d4f7a13
name: Varonis - High severity alerts detected
description: |
  'Identifies high-severity alerts generated by Varonis that indicate high-risk security events requiring immediate triage, investigation, and response.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: VaronisSaaSAlertsPush
    dataTypes:
      - VaronisAlertsV2_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Collection
  - Exfiltration
relevantTechniques:
  - T1530
  - T1213
  - T1567
query: |
  VaronisAlertsV2_CL
  | where AlertSeverity_s == "High"
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})'
  alertDescriptionFormat: 'Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.'
customDetails:
  VaronisAlertGuid: AlertId_g
  AlertCategory: AlertCategory_s
  MitreTactic: MitreTacticName_s
  Status: Status_s
  EventsCount: EventsCount_d
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserNames_s
      - identifier: Name
        columnName: UserSamAccountNames_s
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceNames_s
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

VaronisAlertsV2_CL

Stage 2: `where`

| where AlertSeverity_s == "High"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AlertSeverity_s`	eq	`High`	`field:"AlertSeverity_s" kind:eq value:"High"`