Varonis - Medium severity alerts detected

Status: available
Severity: medium
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Identifies medium-severity alerts generated by Varonis that indicate suspicious activity requiring review and investigation to assess potential security impact.'

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1213` Data from Information Repositories `T1530` Data from Cloud Storage
Exfiltration	`T1567` Exfiltration Over Web Service

Rule body

id: c4e8b16f-3a92-4d75-8e21-6f9c0b5d2a84
name: Varonis - Medium severity alerts detected
description: |
  'Identifies medium-severity alerts generated by Varonis that indicate suspicious activity requiring review and investigation to assess potential security impact.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: VaronisSaaSAlertsPush
    dataTypes:
      - VaronisAlertsV2_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Collection
  - Exfiltration
relevantTechniques:
  - T1530
  - T1213
  - T1567
query: |
  VaronisAlertsV2_CL
  | where AlertSeverity_s == "Medium"
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'Varonis alert: {{ThreatDetectionPolicyName_s}} ({{AlertSeverity_s}})'
  alertDescriptionFormat: 'Varonis detected activity for policy {{ThreatDetectionPolicyName_s}} in category {{AlertCategory_s}}. Users: {{UserNames_s}}.'
customDetails:
  VaronisAlertGuid: AlertId_g
  AlertCategory: AlertCategory_s
  MitreTactic: MitreTacticName_s
  Status: Status_s
  EventsCount: EventsCount_d
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserNames_s
      - identifier: Name
        columnName: UserSamAccountNames_s
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceNames_s
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

VaronisAlertsV2_CL

Stage 2: `where`

| where AlertSeverity_s == "Medium"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AlertSeverity_s`	eq	`Medium`	`field:"AlertSeverity_s" kind:eq value:"Medium"`