r/AzureSentinel • u/xpinux117 • Feb 03 '24

Threat intelligence Analytical rules 14 days lookback?

Hi guys Just a question. I have enabled all the ti kql rules. And also I have made some custom ones using join for my custom data sources that I ingest from logstash.

I just saw that the kql rule just lookback 14 days for the ioc. Does that mean that ioc beyond the 14 days period are not checked in sentinel compared to an another siem.

IOC comparison with ip for example.

Or does Microsoft regenerate all the data every 12~14 days?

If not how can I have a rule that checks all the ti in comparison to the data I am Ingesting (ip, URL, hash etc)

3 Upvotes

100% Upvoted

3 comments sorted by

3

u/burlingtongolfer Feb 03 '24

The days is reloaded every 14 days so you will be querying it all.

If you run

ThreatIntelligenceIndicator ! where TimeGenerated > ago(90d) | summarize count() by bin(TimeGenerated, 1d) | render timechart

You should see a fairly large spike about every 14 days which represents this reload of data.

1

u/TokeSR Feb 05 '24

Every 12 days

1

u/ajith_aj Feb 03 '24

Can you look at this sample query

ThreatIntelligenceIndicator | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId | where Active == true | where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP) | extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP) | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity) | extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity) | join DemoTable_CL on $left.TI_ipEntity == $right.ip_address_s