Skip to content

Commit 0661aec

Browse files
v-dvedakv-dvedak
authored
Merge pull request #13858 from Radargoger/master
SOCRadar: Add SOCRadar Solution V1.0.0
2 parents 90cbc51 + e45c47e commit 0661aec

34 files changed

Lines changed: 5875 additions & 1 deletion

‎.script/tests/KqlvalidationsTests/CustomTables/SOCRadarAuditLog_CL.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"Name": "SOCRadarAuditLog_CL",
3+
"Properties": [
4+
{
5+
"Name": "TimeGenerated",
6+
"Type": "DateTime"
7+
},
8+
{
9+
"Name": "EventType",
10+
"Type": "String"
11+
},
12+
{
13+
"Name": "AlarmId",
14+
"Type": "String"
15+
},
16+
{
17+
"Name": "Message",
18+
"Type": "String"
19+
},
20+
{
21+
"Name": "TenantId",
22+
"Type": "String"
23+
},
24+
{
25+
"Name": "SourceSystem",
26+
"Type": "String"
27+
},
28+
{
29+
"Name": "Type",
30+
"Type": "String"
31+
}
32+
]
33+
}

‎.script/tests/KqlvalidationsTests/CustomTables/SOCRadar_Alarms_CL.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"Name": "SOCRadar_Alarms_CL",
3+
"Properties": [
4+
{"Name": "TimeGenerated", "Type": "DateTime"},
5+
{"Name": "AlarmId", "Type": "String"},
6+
{"Name": "CompanyId", "Type": "String"},
7+
{"Name": "Title", "Type": "String"},
8+
{"Name": "AlarmMainType", "Type": "String"},
9+
{"Name": "AlarmSubType", "Type": "String"},
10+
{"Name": "Severity", "Type": "String"},
11+
{"Name": "Status", "Type": "String"},
12+
{"Name": "AlarmText", "Type": "String"},
13+
{"Name": "AlarmDate", "Type": "String"},
14+
{"Name": "AlarmPayload", "Type": "Dynamic"},
15+
{"Name": "TenantId", "Type": "String"},
16+
{"Name": "SourceSystem", "Type": "String"},
17+
{"Name": "Type", "Type": "String"}
18+
]
19+
}

‎Logos/socradar.svg‎

Lines changed: 4 additions & 0 deletions
Loading

‎Sample Data/Custom/SOCRadarAuditLog_CL.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
[
2+
{
3+
"TimeGenerated": "2026-04-10T08:16:00Z",
4+
"EventType": "AlarmImported",
5+
"AlarmId": "50001",
6+
"IncidentId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
7+
"AlarmType": "Credential Exposure",
8+
"Status": "OPEN",
9+
"Severity": "Critical",
10+
"Message": "Alarm imported to Microsoft Sentinel",
11+
"FullAlarmJson": {"alarm_id": 50001, "alarm_main_type": "Credential Exposure", "severity": "Critical"}
12+
},
13+
{
14+
"TimeGenerated": "2026-04-10T09:23:00Z",
15+
"EventType": "AlarmImported",
16+
"AlarmId": "50002",
17+
"IncidentId": "b2c3d4e5-f678-9012-bcde-f23456789012",
18+
"AlarmType": "Phishing",
19+
"Status": "OPEN",
20+
"Severity": "High",
21+
"Message": "Alarm imported to Microsoft Sentinel",
22+
"FullAlarmJson": {"alarm_id": 50002, "alarm_main_type": "Phishing", "severity": "High"}
23+
},
24+
{
25+
"TimeGenerated": "2026-04-10T10:46:30Z",
26+
"EventType": "AlarmImported",
27+
"AlarmId": "50003",
28+
"IncidentId": "c3d4e5f6-7890-1234-cdef-345678901234",
29+
"AlarmType": "Data Leakage",
30+
"Status": "OPEN",
31+
"Severity": "High",
32+
"Message": "Alarm imported to Microsoft Sentinel",
33+
"FullAlarmJson": {"alarm_id": 50003, "alarm_main_type": "Data Leakage", "severity": "High"}
34+
},
35+
{
36+
"TimeGenerated": "2026-04-10T14:00:00Z",
37+
"EventType": "AlarmSynced",
38+
"AlarmId": "50001",
39+
"IncidentId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
40+
"AlarmType": "Credential Exposure",
41+
"Status": "Closed",
42+
"Severity": "Critical",
43+
"Message": "Incident closed in Microsoft Sentinel, status synced to SOCRadar (FalsePositive -> 9)",
44+
"FullAlarmJson": {"classification": "FalsePositive", "socradar_status": 9}
45+
},
46+
{
47+
"TimeGenerated": "2026-04-10T14:00:05Z",
48+
"EventType": "AlarmSynced",
49+
"AlarmId": "50002",
50+
"IncidentId": "b2c3d4e5-f678-9012-bcde-f23456789012",
51+
"AlarmType": "Phishing",
52+
"Status": "Closed",
53+
"Severity": "High",
54+
"Message": "Incident closed in Microsoft Sentinel, status synced to SOCRadar (TruePositive -> 2)",
55+
"FullAlarmJson": {"classification": "TruePositive", "socradar_status": 2}
56+
},
57+
{
58+
"TimeGenerated": "2026-04-10T15:00:00Z",
59+
"EventType": "Error",
60+
"AlarmId": "50004",
61+
"IncidentId": "",
62+
"AlarmType": "Brand Protection",
63+
"Status": "OPEN",
64+
"Severity": "Medium",
65+
"Message": "SOCRadar API returned 429 Too Many Requests, will retry",
66+
"FullAlarmJson": {"http_status": 429, "retry_after": 30}
67+
}
68+
]

‎Sample Data/Custom/SOCRadar_Alarms_CL.json‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
[
2+
{
3+
"TimeGenerated": "2026-04-10T08:15:30Z",
4+
"AlarmId": "50001",
5+
"CompanyId": "12345",
6+
"AlarmMainType": "Credential Exposure",
7+
"AlarmSubType": "Dark Web",
8+
"Severity": "Critical",
9+
"Status": "OPEN",
10+
"Title": "[SOCRadar] #50001 Credential Exposure on Dark Web",
11+
"AlarmText": "Exposed credentials detected for domain example.com with 42 user accounts found on a dark web marketplace.",
12+
"AlarmDate": "2026-04-10",
13+
"AlarmPayload": {
14+
"source": "darkweb.example",
15+
"records_count": 42,
16+
"breach_name": "sanitized-breach-2026"
17+
}
18+
},
19+
{
20+
"TimeGenerated": "2026-04-10T09:22:10Z",
21+
"AlarmId": "50002",
22+
"CompanyId": "12345",
23+
"AlarmMainType": "Phishing",
24+
"AlarmSubType": "Domain Squatting",
25+
"Severity": "High",
26+
"Status": "OPEN",
27+
"Title": "[SOCRadar] #50002 Phishing Domain Detected",
28+
"AlarmText": "Lookalike domain example-secure.com registered, potentially targeting corporate users.",
29+
"AlarmDate": "2026-04-10",
30+
"AlarmPayload": {
31+
"suspicious_domain": "example-secure.com",
32+
"registrar": "sanitized-registrar",
33+
"registration_date": "2026-04-09"
34+
}
35+
},
36+
{
37+
"TimeGenerated": "2026-04-10T10:45:55Z",
38+
"AlarmId": "50003",
39+
"CompanyId": "12345",
40+
"AlarmMainType": "Data Leakage",
41+
"AlarmSubType": "Paste Site",
42+
"Severity": "High",
43+
"Status": "OPEN",
44+
"Title": "[SOCRadar] #50003 Data Leak on Paste Site",
45+
"AlarmText": "Internal source code fragments containing API keys detected on a public paste site.",
46+
"AlarmDate": "2026-04-10",
47+
"AlarmPayload": {
48+
"paste_url": "https://sanitized-paste.example/abc123",
49+
"leaked_items": [
50+
"api_key",
51+
"database_string"
52+
]
53+
}
54+
},
55+
{
56+
"TimeGenerated": "2026-04-10T11:30:20Z",
57+
"AlarmId": "50004",
58+
"CompanyId": "12345",
59+
"AlarmMainType": "Brand Protection",
60+
"AlarmSubType": "Social Media",
61+
"Severity": "Medium",
62+
"Status": "OPEN",
63+
"Title": "[SOCRadar] #50004 Brand Impersonation on Social Media",
64+
"AlarmText": "Fake social media profile impersonating the organization with 1,200 followers.",
65+
"AlarmDate": "2026-04-10",
66+
"AlarmPayload": {
67+
"platform": "social-sanitized",
68+
"profile_url": "https://sanitized.example/fake-profile",
69+
"follower_count": 1200
70+
}
71+
},
72+
{
73+
"TimeGenerated": "2026-04-10T12:10:45Z",
74+
"AlarmId": "50005",
75+
"CompanyId": "12345",
76+
"AlarmMainType": "Attack Surface",
77+
"AlarmSubType": "Certificate",
78+
"Severity": "Low",
79+
"Status": "OPEN",
80+
"Title": "[SOCRadar] #50005 SSL Certificate Expiry Warning",
81+
"AlarmText": "SSL certificate for example.com expires in 14 days.",
82+
"AlarmDate": "2026-04-10",
83+
"AlarmPayload": {
84+
"domain": "example.com",
85+
"expires_at": "2026-04-24",
86+
"issuer": "sanitized-ca"
87+
}
88+
},
89+
{
90+
"TimeGenerated": "2026-04-10T13:50:30Z",
91+
"AlarmId": "50006",
92+
"CompanyId": "12345",
93+
"AlarmMainType": "Dark Web Monitoring",
94+
"AlarmSubType": "Forum Mention",
95+
"Severity": "Critical",
96+
"Status": "OPEN",
97+
"Title": "[SOCRadar] #50006 Ransomware Mention on Dark Forum",
98+
"AlarmText": "Ransomware group mentioned the organization as an upcoming target on a dark web forum.",
99+
"AlarmDate": "2026-04-10",
100+
"AlarmPayload": {
101+
"forum": "sanitized-forum",
102+
"threat_actor": "sanitized-group",
103+
"post_date": "2026-04-10"
104+
}
105+
},
106+
{
107+
"TimeGenerated": "2026-04-10T14:25:15Z",
108+
"AlarmId": "50007",
109+
"CompanyId": "12345",
110+
"AlarmMainType": "Attack Surface",
111+
"AlarmSubType": "Exposed Service",
112+
"Severity": "High",
113+
"Status": "OPEN",
114+
"Title": "[SOCRadar] #50007 Exposed Internal Service Detected",
115+
"AlarmText": "Internal database service exposed on port 5432 without authentication.",
116+
"AlarmDate": "2026-04-10",
117+
"AlarmPayload": {
118+
"ip": "203.0.113.10",
119+
"port": 5432,
120+
"service": "postgresql"
121+
}
122+
},
123+
{
124+
"TimeGenerated": "2026-04-10T15:40:00Z",
125+
"AlarmId": "50008",
126+
"CompanyId": "12345",
127+
"AlarmMainType": "Phishing",
128+
"AlarmSubType": "Lookalike Domain",
129+
"Severity": "Medium",
130+
"Status": "OPEN",
131+
"Title": "[SOCRadar] #50008 Suspicious Domain Registration",
132+
"AlarmText": "New lookalike domain examp1e.com registered with typosquatting pattern.",
133+
"AlarmDate": "2026-04-10",
134+
"AlarmPayload": {
135+
"suspicious_domain": "examp1e.com",
136+
"typosquatting_score": 0.92
137+
}
138+
}
139+
]

‎Solutions/SOCRadar/Analytic Rules/SOCRadarAlarmVolumeSpike.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
id: 4a7b3c9e-2d15-4e8f-b6a3-9c2e7d5a1b4f
2+
name: SOCRadar Alarm Volume Spike
3+
description: |
4+
'Detects unusual spikes in SOCRadar alarm volume that may indicate an active campaign, coordinated attack, or data breach. Triggers when alarm count in the last hour exceeds the 7-day hourly average by more than 3x.'
5+
severity: Medium
6+
status: Available
7+
requiredDataConnectors: []
8+
queryFrequency: 1h
9+
queryPeriod: 7d
10+
triggerOperator: gt
11+
triggerThreshold: 0
12+
tactics:
13+
- Impact
14+
- Exfiltration
15+
relevantTechniques:
16+
- T1485
17+
- T1567
18+
query: |
19+
let baseline = SOCRadar_Alarms_CL
20+
| where TimeGenerated > ago(7d) and TimeGenerated < ago(1h)
21+
| summarize AvgHourly = count() / 168.0;
22+
let recent = SOCRadar_Alarms_CL
23+
| where TimeGenerated > ago(1h)
24+
| summarize RecentCount = count() by AlarmMainType;
25+
recent
26+
| extend BaselineAvg = toscalar(baseline)
27+
| where RecentCount > (BaselineAvg * 3) and RecentCount > 5
28+
| extend SpikeRatio = round(RecentCount / BaselineAvg, 2)
29+
| extend timestamp = now()
30+
| extend AccountName = AlarmMainType
31+
entityMappings:
32+
- entityType: Malware
33+
fieldMappings:
34+
- identifier: Name
35+
columnName: AccountName
36+
version: 1.0.0
37+
kind: Scheduled

‎Solutions/SOCRadar/Analytic Rules/SOCRadarCriticalAlarmDetection.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
id: 8f3e2c5a-7b91-4d6a-9e8f-1c4a2b5d7e3f
2+
name: SOCRadar High or Critical Severity Alarm
3+
description: |
4+
'Detects SOCRadar alarms with High or Critical severity levels that require immediate attention. These alarms typically indicate active threats such as credential exposure, ransomware mentions, or targeted attacks against the organization.'
5+
severity: High
6+
status: Available
7+
requiredDataConnectors: []
8+
queryFrequency: 15m
9+
queryPeriod: 15m
10+
triggerOperator: gt
11+
triggerThreshold: 0
12+
tactics:
13+
- Reconnaissance
14+
- InitialAccess
15+
relevantTechniques:
16+
- T1589
17+
- T1078
18+
query: |
19+
SOCRadar_Alarms_CL
20+
| where Severity in ("High", "Critical")
21+
| where Status == "OPEN"
22+
| extend AlarmUrl = strcat("https://platform.socradar.com/company/", CompanyId, "/alarms/", AlarmId)
23+
| extend AccountName = tostring(AlarmId)
24+
| project TimeGenerated, AlarmId, Title, AlarmMainType, AlarmSubType, Severity, Status, AlarmUrl, AccountName
25+
entityMappings:
26+
- entityType: Malware
27+
fieldMappings:
28+
- identifier: Name
29+
columnName: AlarmMainType
30+
- identifier: Category
31+
columnName: AlarmSubType
32+
- entityType: URL
33+
fieldMappings:
34+
- identifier: Url
35+
columnName: AlarmUrl
36+
version: 1.0.0
37+
kind: Scheduled

‎Solutions/SOCRadar/Analytic Rules/SOCRadarUnsyncedClosedIncident.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
id: 6e2f8d4b-5a71-4c9e-b3f6-8a1c9d4e7b2a
2+
name: SOCRadar Unsynced Closed Incident
3+
description: |
4+
'Detects Microsoft Sentinel incidents tagged as SOCRadar that were closed more than 30 minutes ago but do not have the Synced tag. This may indicate the SOCRadar-Alarm-Sync playbook has failed to update the SOCRadar platform with the closure status.'
5+
severity: Low
6+
status: Available
7+
requiredDataConnectors: []
8+
queryFrequency: 1h
9+
queryPeriod: 1d
10+
triggerOperator: gt
11+
triggerThreshold: 0
12+
tactics:
13+
- Discovery
14+
relevantTechniques:
15+
- T1526
16+
query: |
17+
SecurityIncident
18+
| where Labels has "SOCRadar"
19+
| where Status == "Closed"
20+
| where LastModifiedTime < ago(30m)
21+
| where not(Labels has "Synced")
22+
| extend AlarmId = extract(@"#(\d+)", 1, Title)
23+
| extend AccountName = AlarmId
24+
| project TimeGenerated, IncidentName, Title, Status, Classification, LastModifiedTime, AlarmId, AccountName
25+
entityMappings:
26+
- entityType: Account
27+
fieldMappings:
28+
- identifier: Name
29+
columnName: AccountName
30+
version: 1.0.0
31+
kind: Scheduled

0 commit comments

Comments
 (0)