44 строки
1.6 KiB
YAML
44 строки
1.6 KiB
YAML
id: af245eff-0db9-4df8-82e6-998185cac332
|
|
name: AIShield - Tabular classification AI Model Evasion low suspicious vulnerability detection
|
|
description: |
|
|
'This alert creates an incident when Tabular classification AI Model Evasion Low suspicious, medium severity vulnerability detected from the AIShield.'
|
|
severity: Medium
|
|
status: Available
|
|
requiredDataConnectors:
|
|
- connectorId: BoschAIShield
|
|
dataTypes:
|
|
- AIShield
|
|
queryFrequency: 1h
|
|
queryPeriod: 1h
|
|
triggerOperator: gt
|
|
triggerThreshold: 0
|
|
tactics: []
|
|
relevantTechniques: []
|
|
query: |
|
|
AIShield
|
|
| where Message has 'Tabular Classification AI Model Evasion Attack Identified'
|
|
| where Severity =~ 'Medium'
|
|
| where SuspiciousLevel =~ 'low suspicious attack'
|
|
| extend NTDomain = tostring(split(Computer, '\\')[0]), HostName = tostring(split(Computer, '.')[0])
|
|
entityMappings:
|
|
- entityType: Host
|
|
fieldMappings:
|
|
- identifier: HostName
|
|
columnName: HostName
|
|
- identifier: NTDomain
|
|
columnName: NTDomain
|
|
- entityType: IP
|
|
fieldMappings:
|
|
- identifier: Address
|
|
columnName: SourceName
|
|
eventGroupingSettings:
|
|
aggregationKind: SingleAlert
|
|
alertDetailsOverride:
|
|
alertDisplayNameFormat: AIShield - Tabular Classification AI Model Evasion low suspicious vulnerability detected.
|
|
alertDescriptionFormat: |
|
|
This query detects Tabular Classification AI Model Evasion low suspicious, medium severity alert from AIShield generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
|
|
alertTacticsColumnName: null
|
|
alertSeverityColumnName: Severity
|
|
version: 1.0.4
|
|
kind: Scheduled
|