Varonis - Low severity alerts detected

Status: available
Severity: low
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Identifies low-severity alerts generated by Varonis that indicate lower-risk activity supporting ongoing analysis, threat correlation, and security monitoring.'

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1213` Data from Information Repositories `T1530` Data from Cloud Storage
Exfiltration	`T1567` Exfiltration Over Web Service

Rule body

id: 9b1f3e7a-6c42-4d18-a5e9-2b7f8c0d4e61
name: Varonis - Low severity alerts detected
description: |
  'Identifies low-severity alerts generated by Varonis that indicate lower-risk activity supporting ongoing analysis, threat correlation, and security monitoring.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: VaronisSaaSAlertsPush
    dataTypes:
      - VaronisAlertsV2_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Collection
  - Exfiltration
relevantTechniques:
  - T1530
  - T1213
  - T1567
query: |
  VaronisAlertsV2_CL
  | where AlertSeverity_s == "Low"
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})'
  alertDescriptionFormat: 'Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.'
customDetails:
  VaronisAlertGuid: AlertId_g
  AlertCategory: AlertCategory_s
  MitreTactic: MitreTacticName_s
  Status: Status_s
  EventsCount: EventsCount_d
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserNames_s
      - identifier: Name
        columnName: UserSamAccountNames_s
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceNames_s
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

VaronisAlertsV2_CL

Stage 2: `where`

| where AlertSeverity_s == "Low"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AlertSeverity_s`	eq	`Low`	`field:"AlertSeverity_s" kind:eq value:"Low"`