44 строки
1.6 KiB
YAML
44 строки
1.6 KiB
YAML
id: c4bedb3c-4fb8-4b1c-af5b-8229bd25f521
|
|
name: AIShield - Image classification AI Model Evasion low suspicious vulnerability detection
|
|
description: |
|
|
'This alert creates an incident when Image classification AI Model Evasion low suspicious, high severity vulnerability detected from the AIShield.'
|
|
severity: High
|
|
status: Available
|
|
requiredDataConnectors:
|
|
- connectorId: BoschAIShield
|
|
dataTypes:
|
|
- AIShield
|
|
queryFrequency: 1h
|
|
queryPeriod: 1h
|
|
triggerOperator: gt
|
|
triggerThreshold: 0
|
|
tactics: []
|
|
relevantTechniques: []
|
|
query: |
|
|
AIShield
|
|
| where Message has 'Image Classification AI Model Evasion Attack Identified'
|
|
| where Severity =~ 'Medium'
|
|
| where SuspiciousLevel =~ 'low suspicious attack'
|
|
| extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])
|
|
entityMappings:
|
|
- entityType: Host
|
|
fieldMappings:
|
|
- identifier: HostName
|
|
columnName: HostName
|
|
- identifier: NTDomain
|
|
columnName: NTDomain
|
|
- entityType: IP
|
|
fieldMappings:
|
|
- identifier: Address
|
|
columnName: SourceName
|
|
eventGroupingSettings:
|
|
aggregationKind: SingleAlert
|
|
alertDetailsOverride:
|
|
alertDisplayNameFormat: AIShield - Image Classification AI Model Evasion low suspicious vulnerability detected.
|
|
alertDescriptionFormat: |
|
|
This query detects Image Classification AI Model Evasion low suspicious, medium severity alert from AIShield generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
|
|
alertTacticsColumnName: null
|
|
alertSeverityColumnName: Severity
|
|
version: 1.0.4
|
|
kind: Scheduled
|