Skip to content

Commit 0cc8664

Browse files
RadargogerRadargoger
committed
SOCRadar-Solution
1 parent b129a28 commit 0cc8664

17 files changed

+1345
-0
lines changed

‎Solutions/SOCRadar/Data/Solution_SOCRadar.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{
2+
"Name": "SOCRadar",
3+
"Author": "SOCRadar - integration@socradar.io",
4+
"Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SOCRadar/logo/socradar.svg\" width=\"75px\" height=\"75px\">",
5+
"Description": "The SOCRadar solution for Microsoft Sentinel provides bidirectional integration between SOCRadar XTI Platform and Microsoft Sentinel. Import alarms as incidents, sync closed incidents back to SOCRadar with classification mapping.",
6+
"Version": "3.0.0",
7+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\SOCRadar",
8+
"TemplateSpec": true,
9+
"Is1Pconnector": false,
10+
"Metadata": "SolutionMetadata.json",
11+
"Workbooks": [
12+
"Workbooks/SOCRadar-Dashboard.json"
13+
],
14+
"Hunting Queries": [
15+
"Hunting Queries/SOCRadar-Alarm-Overview.yaml",
16+
"Hunting Queries/SOCRadar-Critical-Alarms.yaml",
17+
"Hunting Queries/SOCRadar-Alarm-Trends.yaml",
18+
"Hunting Queries/SOCRadar-Incident-Correlation.yaml",
19+
"Hunting Queries/SOCRadar-Audit-Analysis.yaml"
20+
],
21+
"Playbooks": [
22+
"Playbooks/SOCRadar-Alarm-Import/azuredeploy.json",
23+
"Playbooks/SOCRadar-Alarm-Sync/azuredeploy.json"
24+
]
25+
}

‎Solutions/SOCRadar/Hunting Queries/SOCRadar-Alarm-Overview.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
id: 12a3dfda-ab80-4664-aed9-7f6f9f3b4a23
2+
name: SOCRadar Alarm Overview
3+
description: |
4+
'Overview of SOCRadar alarms imported into Microsoft Sentinel, grouped by type and severity.'
5+
description-detailed: |
6+
'This query provides a summary view of all SOCRadar alarms imported into Microsoft Sentinel.
7+
It groups alarms by their main type and severity level to help analysts identify the most common and critical threat categories.'
8+
requiredDataConnectors: []
9+
tactics:
10+
- Discovery
11+
query: |
12+
SOCRadar_Alarms_CL
13+
| summarize Count=count() by AlarmMainType, Severity
14+
| order by Count desc
15+
version: 1.0.0

‎Solutions/SOCRadar/Hunting Queries/SOCRadar-Alarm-Trends.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: bbafd1c6-8da9-4de3-b100-6964dedd3f3e
2+
name: SOCRadar Alarm Trends
3+
description: |
4+
'Analyze SOCRadar alarm trends over the past 7 days to identify patterns and spikes.'
5+
description-detailed: |
6+
'This query analyzes SOCRadar alarm volume over time, grouped by hour and alarm type.
7+
Use this to detect unusual spikes in specific alarm categories that may indicate an active campaign or emerging threat.'
8+
requiredDataConnectors: []
9+
tactics:
10+
- Discovery
11+
query: |
12+
SOCRadar_Alarms_CL
13+
| where TimeGenerated > ago(7d)
14+
| summarize Count=count() by bin(TimeGenerated, 1h), AlarmMainType
15+
| order by TimeGenerated desc
16+
version: 1.0.0

‎Solutions/SOCRadar/Hunting Queries/SOCRadar-Audit-Analysis.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
id: afae44e5-e2e2-4f0e-9535-2aeb3766a847
2+
name: SOCRadar Audit Analysis
3+
description: |
4+
'Analyze SOCRadar audit logs to monitor import and sync operations.'
5+
description-detailed: |
6+
'This query summarizes SOCRadar audit log events by type to help monitor the health of import and sync operations.
7+
Use this to detect errors or unexpected patterns in the integration workflow.'
8+
requiredDataConnectors: []
9+
tactics:
10+
- Discovery
11+
query: |
12+
SOCRadarAuditLog_CL
13+
| summarize Count=count() by EventType
14+
| order by Count desc
15+
version: 1.0.0

‎Solutions/SOCRadar/Hunting Queries/SOCRadar-Critical-Alarms.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: ffa80945-44de-4900-bda5-9f1410c60166
2+
name: SOCRadar Critical Alarms
3+
description: |
4+
'Hunt for high and critical severity SOCRadar alarms that may require immediate attention.'
5+
description-detailed: |
6+
'This query filters SOCRadar alarms to show only High and Critical severity items.
7+
Use this to prioritize investigation of the most impactful threats detected by SOCRadar XTI platform.'
8+
requiredDataConnectors: []
9+
tactics:
10+
- Impact
11+
query: |
12+
SOCRadar_Alarms_CL
13+
| where Severity in ("High", "Critical")
14+
| project TimeGenerated, AlarmId, Title, AlarmMainType, AlarmSubType, Severity, Status
15+
| order by TimeGenerated desc
16+
version: 1.0.0

‎Solutions/SOCRadar/Hunting Queries/SOCRadar-Incident-Correlation.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
id: 3a665ce4-b824-4a79-861b-c9f80ab4daba
2+
name: SOCRadar Incident Correlation
3+
description: |
4+
'Correlate SOCRadar alarms with Sentinel incidents to track import status and identify gaps.'
5+
description-detailed: |
6+
'This query examines Microsoft Sentinel incidents tagged with SOCRadar label to provide a summary of incident status and classification.
7+
Use this to verify that imported alarms are being properly triaged and to identify any gaps in the sync process.'
8+
requiredDataConnectors: []
9+
tactics:
10+
- Discovery
11+
query: |
12+
SecurityIncident
13+
| where Labels has "SOCRadar"
14+
| summarize Count=count() by Status, Classification
15+
| order by Count desc
16+
version: 1.0.0

‎Solutions/SOCRadar/Playbooks/SOCRadar-Alarm-Import/azuredeploy.json‎

Lines changed: 579 additions & 0 deletions
Large diffs are not rendered by default.

‎Solutions/SOCRadar/Playbooks/SOCRadar-Alarm-Import/readme.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# SOCRadar Alarm Import
2+
3+
Imports SOCRadar XTI platform alarms into Microsoft Sentinel as incidents.
4+
5+
## Features
6+
7+
- Paginated alarm fetching (100 per page)
8+
- Duplicate detection via Sentinel API
9+
- Severity and status mapping
10+
- Optional closed alarm import with classification
11+
- Automatic tagging (SOCRadar, alarm type, sub type)
12+
- Field truncation for large alarms
13+
- Optional audit logging
14+
15+
## Prerequisites
16+
17+
- SOCRadar XTI Platform API Key
18+
- Microsoft Sentinel workspace
19+
- Managed Identity with Sentinel Contributor role
20+
21+
## Deployment
22+
23+
Deploy via the main SOCRadar solution or standalone using the Deploy to Azure button in the main repository.

0 commit comments

Comments
 (0)