Merge pull request #91 from JupiterOne/KNO-256

added critical-assets-critical-alert rule
JupiterOne · Jan 23, 2024 · 091bd5d · 091bd5d
2 parents 36eb129 + c66a7cc
commit 091bd5d
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@jupiterone/jupiterone-alert-rules",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "Alert rule packages for the JupiterOne platform",
   "repository": {
     "type": "git",

diff --git a/rule-packs/critical-assets.json b/rule-packs/critical-assets.json
@@ -8,7 +8,8 @@
         "query": "Find #CriticalAsset with _createdOn >= date.now-24hours",
         "version": "v1"
       }
-    ]
+    ],
+    "alertLevel": "INFO"
   },
   {
     "name": "critical-assets-deleted",
@@ -34,5 +35,17 @@
       }
     ],
     "alertLevel": "CRITICAL"
+  },
+  {
+    "name": "critical-assets-critical-alert",
+    "description": "Find critical assets with a critical alert associated. These Detections, Problems, or Misconfigurations should be triaged and resolved as a priority.",
+    "queries": [
+      {
+        "name": "query0",
+        "query": "FIND #CriticalAsset THAT HAS Alert WITH level = 'CRITICAL' AND displayName != 'critical-assets-critical-alert'",
+        "version": "v1"
+      }
+    ],
+    "alertLevel": "CRITICAL"
   }
 ]