Domain tool ccf

Solutions/DomainTools CCF/Analytic Rules/DomainTools_DomainDiscovery-DD.yaml

@@ -0,0 +1,24 @@
+id: f8c223c1-1a28-4b28-8e9f-5e33b610916b
+name: DomainTools New Domain Discovery Indicators Ingested
+description: Creates an incident whenever DomainTools Domain Discovery new indicators (domains) are ingested in the last 1 hour.
+kind: Scheduled
+severity: Medium
+requiredDataConnectors:
+  - connectorId: DomainTools
+    dataTypes:
+      - DomainToolsThreatIntelDomains_CL
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics: []
+relevantTechniques: []
+query: "DomainToolsThreatIntelDomains_CL\r\n| where TimeGenerated >= ago(1h)\r\n| where domaintype == \"domaindiscovery\"            \r\n| project\r\n    TimeGenerated,\r\n    domain,\r\n    domaintype,\r\n    SourceTable = Type\r\n| extend\r\n    DomainCustomEntity = domain        \r\n"
+entityMappings:
+  - entityType: DNS
+    fieldMappings:
+      - identifier: DomainName
+        columnName: DomainCustomEntity
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+version: 1.0.0

Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyAddedDomains-NAD.yaml

@@ -0,0 +1,24 @@
+id: f8c223c1-1a28-4b28-8e9f-5e34b610916b
+name: DomainTools Newly Added Domains Feeds Ingested
+description: Creates an incident whenever DomainTools Domain Discovery new Feeds (domains) are ingested in the last 1 hour.
+kind: Scheduled
+severity: Medium
+requiredDataConnectors:
+  - connectorId: DomainTools
+    dataTypes:
+      - DomainToolsThreatIntelDomains_CL
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics: []
+relevantTechniques: []
+query: "DomainToolsThreatIntelDomains_CL\r\n| where TimeGenerated >= ago(1h)\r\n| where domaintype == \"nad\"            \r\n| project\r\n    TimeGenerated,\r\n    domain,\r\n    domaintype,\r\n    SourceTable = Type\r\n| extend\r\n    DomainCustomEntity = domain        \r\n"
+entityMappings:
+  - entityType: DNS
+    fieldMappings:
+      - identifier: DomainName
+        columnName: DomainCustomEntity
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+version: 1.0.0

Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedDomains-NOD.yaml

@@ -0,0 +1,24 @@
+id: f8c223c1-1a28-4b28-8e9f-5e35b610916b
+name: DomainTools Newly Observed Domains Feeds Ingested
+description: Creates an incident whenever DomainTools Newly Observed Domains new Feeds (domains) are ingested in the last 1 hour.
+kind: Scheduled
+severity: Medium
+requiredDataConnectors:
+  - connectorId: DomainTools
+    dataTypes:
+      - DomainToolsThreatIntelDomains_CL
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics: []
+relevantTechniques: []
+query: "DomainToolsThreatIntelDomains_CL\r\n| where TimeGenerated >= ago(1h)\r\n| where domaintype == \"nod\"            \r\n| project\r\n    TimeGenerated,\r\n    domain,\r\n    domaintype,\r\n    SourceTable = Type\r\n| extend\r\n    DomainCustomEntity = domain        \r\n"
+entityMappings:
+  - entityType: DNS
+    fieldMappings:
+      - identifier: DomainName
+        columnName: DomainCustomEntity
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+version: 1.0.0

Solutions/DomainTools CCF/Analytic Rules/DomainTools_NewlyObservedHostnames-NOH.yaml

@@ -0,0 +1,24 @@
+id: f8c223c1-1a28-4b28-8e9f-5e36b610916b
+name: DomainTools Newly Observed Hostnames Feeds Ingested
+description: Creates an incident whenever DomainTools Newly Observed Hostnames new Feeds (domains) are ingested in the last 1 hour.
+kind: Scheduled
+severity: Medium
+requiredDataConnectors:
+  - connectorId: DomainTools
+    dataTypes:
+      - DomainToolsThreatIntelDomains_CL
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics: []
+relevantTechniques: []
+query: "DomainToolsThreatIntelDomains_CL\r\n| where TimeGenerated >= ago(1h)\r\n| where domaintype == \"noh\"            \r\n| project\r\n    TimeGenerated,\r\n    domain,\r\n    domaintype,\r\n    SourceTable = Type\r\n| extend\r\n    DomainCustomEntity = domain        \r\n"
+entityMappings:
+  - entityType: DNS
+    fieldMappings:
+      - identifier: DomainName
+        columnName: DomainCustomEntity
+eventGroupingSettings:
+  aggregationKind: SingleAlert
+version: 1.0.0

Solutions/DomainTools CCF/Analytic Rules/arm_Templates_Analytic_Rules/DomainTools_DomainDiscovery-DD.json

@@ -0,0 +1,66 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "workspace": {
+            "type": "String"
+        }
+    },
+    "resources": [
+        {
+            "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f8c223c1-1a28-4b28-8e9f-5e33b610916b')]",
+            "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f8c223c1-1a28-4b28-8e9f-5e33b610916b')]",
+            "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
+            "kind": "Scheduled",
+            "apiVersion": "2023-12-01-preview",
+            "properties": {
+                "displayName": "DomainTools Domains Discovery",
+                "description": "",
+                "severity": "Medium",
+                "enabled": true,
+                "query": "DomainToolsThreatIntelDomains_CL\r\n| where TimeGenerated >= ago(1h)\r\n| where domaintype == \"domaindiscovery\"            \r\n| project\r\n    TimeGenerated,\r\n    domain,\r\n    domaintype,\r\n    SourceTable = Type\r\n| extend\r\n    DomainCustomEntity = domain        \r\n",
+                "queryFrequency": "P1H",
+                "queryPeriod": "P1H",
+                "triggerOperator": "GreaterThan",
+                "triggerThreshold": 0,
+                "suppressionDuration": "PT1H",
+                "suppressionEnabled": false,
+                "startTimeUtc": null,
+                "tactics": [],
+                "techniques": [],
+                "subTechniques": [],
+                "alertRuleTemplateName": null,
+                "incidentConfiguration": {
+                    "createIncident": true,
+                    "groupingConfiguration": {
+                        "enabled": false,
+                        "reopenClosedIncident": false,
+                        "lookbackDuration": "PT1H",
+                        "matchingMethod": "AllEntities",
+                        "groupByEntities": [],
+                        "groupByAlertDetails": [],
+                        "groupByCustomDetails": []
+                    }
+                },
+                "eventGroupingSettings": {
+                    "aggregationKind": "SingleAlert"
+                },
+                "alertDetailsOverride": null,
+                "customDetails": null,
+                "entityMappings": [
+                    {
+                        "entityType": "DNS",
+                        "fieldMappings": [
+                            {
+                                "identifier": "DomainName",
+                                "columnName": "DomainCustomEntity"
+                            }
+                        ]
+                    }
+                ],
+                "sentinelEntitiesMappings": null,
+                "templateVersion": null
+            }
+        }
+    ]
+}