Guardian- Invisible Text Policy Violation Detection

Guardian
| where PolicyViolatedControlFeature =~ 'Invisible Text'
| where Severity =~ 'Low'

tactics: []
triggerThreshold: 0
queryPeriod: 1h
id: 1e31a465-e25d-4810-881b-8a79e0de9379
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'Invisible Text'
  | where Severity =~ 'Low'  
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 1h
alertDetailsOverride:
  alertDescriptionFormat: |
        This query detects Invisible Text Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
  alertSeverityColumnName: Severity
  alertTacticsColumnName: 
  alertDisplayNameFormat: Guardian- Invisible Text Policy Violation detection
relevantTechniques: []
description: |
    'This alert creates an incident when Invisible Text Policy Violation detected from the Guardian.'
name: Guardian- Invisible Text Policy Violation Detection
status: Available
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: NTDomain
    columnName: NTDomain
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
requiredDataConnectors:
- connectorId: BoschAIShield
  dataTypes:
  - Guardian
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/InvisibleTextVulDetection.yaml
severity: Low
kind: Scheduled
version: 1.0.0