Microsoft Sentinel high experimental kql

Critical Finding Overdue on Internet-Facing App

Detects Critical and High severity findings older than 7 days that remain open on internet-facing applications. Uses the InternetFacingApps watchlist to scope results to externally exposed assets requiring urgent remediation.

View Source

Detection Logic

let maxAgeDays = 7;
let InternetFacingList = _GetWatchlist("InternetFacingApps")
| project WL_ApplicationId = column_ifexists("ApplicationId", ""),
        WL_AppName = column_ifexists("AppName", ""),
        WL_Owner = column_ifexists("Owner", "");
StratoSecure_Findings_CL
| where FixStatus =~ "open"
| where Severity in ("Critical", "High")
| extend AgeInDays = datetime_diff("day", now(), TimeGenerated)
| where AgeInDays > maxAgeDays
| join kind=inner InternetFacingList on $left.ApplicationId == $right.WL_ApplicationId
| summarize TotalOverdueFindings = count(), OldestAge = max(AgeInDays),
        RuleIds = make_set(RuleId, 20), EndTime = max(TimeGenerated)
        by ApplicationId, WL_AppName, WL_Owner, StraTenantId
| project TimeGenerated = EndTime, ApplicationId, AppName = WL_AppName, Owner = WL_Owner,
        StraTenantId, TotalOverdueFindings, OldestAge, RuleIds

Field Validations

Loading…

Comments (0)

Loading comments...