35 строки
1.1 KiB
YAML
35 строки
1.1 KiB
YAML
id: d8844f11-3a36-4b97-9062-1e6d57c00e37
|
|
name: BitSight - drop in company ratings
|
|
description: |
|
|
'Rule helps to detect when there is a drop of 10% or more in BitSight company ratings.'
|
|
severity: High
|
|
status: Available
|
|
requiredDataConnectors:
|
|
- connectorId: BitSight
|
|
dataTypes:
|
|
- BitSightGraphData
|
|
queryFrequency: 1d
|
|
queryPeriod: 24h
|
|
triggerOperator: GreaterThan
|
|
triggerThreshold: 0
|
|
tactics:
|
|
- CommandAndControl
|
|
query: |
|
|
let timeframe = 24h;
|
|
BitSightGraphData
|
|
| where ingestion_time() > ago(timeframe)and toint(RatingDifferance) < 0
|
|
| extend percentage = -(toreal(RatingDifferance)/toreal(Rating))*100
|
|
| where percentage >= 10
|
|
| project RatingDate, Rating, CompanyName, percentage
|
|
incidentConfiguration:
|
|
createIncident: false
|
|
eventGroupingSettings:
|
|
aggregationKind: AlertPerResult
|
|
alertDetailsOverride:
|
|
alertDisplayNameFormat: 'BitSight : Alert for >10% drop in ratings of {{CompanyName}}.'
|
|
alertDescriptionFormat: 'Alert is generated for {{CompanyName}}.\n\nRating Date: {{RatingDate}}\nPercentage Drop: {{percentage}}%'
|
|
customDetails:
|
|
CompanyName: CompanyName
|
|
CompanyRating: Rating
|
|
version: 1.0.0
|
|
kind: Scheduled |