No Analytics Rule for Dark Trace??

[FahadAhmed]

Hello, 

We have a client having Dark Trace installed within their environment and we have Data Connector enabled. however I dont see any Analytics rule associated with Dark Trace. Is it to any worth to integrate Dark Trace with Azure Sentinel?? 

Since to-date I have never seen any alert being generated, while if I go to the Dark Trace workbook it shows some malicious activities?? Just want to understand the value of the integration?? Are the events from workbook considered malicious, if yes then why no Analytics rule in place to trigger incidents??

Thanks 

Fahad.

[#2]

@FahadAhmed You will see that a lot of the data connectors, especially those written by third parties, do not have any associate analytic rules.  It is up to the 3rd party as to what to provide with their data connector.   Hopefully, with the advent of the Content Hub, this will happen less and less as the analytic rules can be combined with the data connectors.

Based on the description of the Darktrace workbook, I would say the malicious activities shown are indeed items that need to be investigated.  I would also suggest looking at the KQL in the workbook and seeing if you can use that to make your Analytics rules to create the alerts.

[#3]

....and if you do create some Rules (or anything really) if you are happy sharing with the community, please see https://github.com/Azure/Azure-Sentinel#contributing

[#4]

@Clive_Watson 

Have someone been able to create some analytics rules for Darktrace?

[#5]

@Magnus Tengmo There are three out of the box now

or go to the Github: Azure-Sentinel/Solutions/Darktrace/Analytic Rules at f99d6c8fd39bb3751f41ed8dfe059f2b2c9d1130 · Azur...

[#6]

Double that! I'd also start by investigating the queries in the workbook and create own analytics rules first. Also would hope for more rules with the deployment via content hub, but it seems there are some now.

[#7]

A word of warning, if it is for a client, the DarkTrace logs are desperate lacking in verbosity. It just sends alerts. 95% of the time you will need access to the DarkTrace console to actually find out the affected entities. For example, I get alerts about High DGA/Low TTL DNS requests. The logs neither give me the DNS name or the IP address of the activity which caused the alert. You have to go into DarkTrace to see the domain, and then back into Sentinel to query DNS logs.

CommonSecurityLog
| where DeviceVendor == "Darktrace"

Use the above as an incident rule to create a new alert per result returned. Then set the incident setting to create a new incident per alert (you could do some alert grouping or certain entities).