Custom AI Alert Rules in Azure Sentinel

Question

Pulumi · Accepted Answer

To create custom AI alert rules in Azure Sentinel using Pulumi, you will typically use resources from the Azure Native provider. Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Through Azure Sentinel, you can collect data across your enterprise, detect threats, investigate threats with artificial intelligence, and respond to incidents rapidly.

To define custom alert rules, we'll use the `ScheduledAlertRule` resource from the `azure-native` Pulumi package. This resource allows you to create alert rules that will execute at a set frequency and look for specific patterns or anomalies in your data, potentially indicating a security threat.

Below is a basic example of how to create such a rule. We will create a scheduled alert rule that will analyze logs within Azure Sentinel to identify potential threats. The `query` parameter must contain a valid Kusto Query Language (KQL) query that Azure Sentinel will use to evaluate the log data.

In this setup:

- We define an alert rule with a `query` that should be tailored to your specific data and threat detection needs.
- We set the `queryFrequency` and `queryPeriod`, which indicate how often the query should run and over what period it should analyze the data.
- The `triggerOperator` and `triggerThreshold` define the conditions under which an alert is fired.
- The `enabled` parameter turns the alert rule on and off.
- The `tactics` and `severity` indicate the tactics used by the threat and its severity level, which you can use for filtering and prioritization in threat response.

Let's write a Pulumi program in Python to demonstrate:
```python
import pulumi
import pulumi_azure_native.securityinsights as securityinsights

# Configure the required resource parameters.
resource_group_name = "myResourceGroup"
workspace_name = "myLogAnalyticsWorkspace"

# Create a Scheduled Alert Rule in Azure Sentinel.
scheduled_alert_rule = securityinsights.ScheduledAlertRule(
    "myScheduledAlertRule",
    # Replace with the appropriate resource group and Log Analytics Workspace names.
    resource_group_name=resource_group_name,
    workspace_name=workspace_name,
    
    # Required parameters for the alert rule.
    display_name="My Custom AI Alert Rule",
    enabled=True,
    severity="High",
    query="""SecurityEvent
             | where TimeGenerated > ago(1d)
             | where Account contains 'suspicious_account'""",
    query_frequency="PT5M",  # Run the query every 5 minutes.
    query_period="PT1H",     # Analyze the last 1 hour of data.
    trigger_operator="GreaterThan",
    trigger_threshold=5,     # Trigger the alert if the query results more than 5 times.
    suppression_enabled=False, 
    
    # Optionally, add more information about the rule, such as tactics, techniques.
    tactics=["Persistence", "PrivilegeEscalation"],
    # Other optional parameters could include techniques, alert details override, event grouping settings, etc.
)

# Output the ID of the Scheduled Alert Rule.
pulumi.export('scheduled_alert_rule_id', scheduled_alert_rule.id)
```

In this program, we defined a scheduled alert rule named "myScheduled AlertRule" with specific parameters on how and when it should run and alert you. Tailor the `query` parameter based on the threat detection logic pertinent to your environment and the investigation workflows set up within your Azure Sentinel instance.

Lastly, the program exports the ID of the scheduled alert rule, which you can use to reference the created rule or integrate further within your Pulumi stack or outside processes.

Remember to replace the placeholder values for `resource_group_name` and `workspace_name` with your actual resource group and Log Analytics Workspace names within which Azure Sentinel is deployed. Similarly, the KQL within the query should be modified to suit the actual logic that's intended to be used for alerts within your organization.