{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/231904f5-b670-4223-9bec-2e9aeca9cf5a')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/231904f5-b670-4223-9bec-2e9aeca9cf5a')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Vectra AI has escalated detection {{detection_name}} ({{detection_category}}) on account or identified account {{entity_name}} as a priority threat. See custom details for full context.\n",
          "alertDisplayNameFormat": "Vectra AI - {{detection_name}} on {{entity_name}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "entity_url"
            },
            {
              "alertProperty": "Techniques",
              "value": "mitre_techniques"
            }
          ]
        },
        "alertRuleTemplateName": "231904f5-b670-4223-9bec-2e9aeca9cf5a",
        "customDetails": {
          "assigned_to": "assigned_to",
          "category": "detection_category",
          "detection_id": "detection_id",
          "detection_name": "detection_name",
          "entity_id": "entity_id",
          "entity_type": "entity_type",
          "entity_uid": "entity_uid",
          "entity_url": "entity_url",
          "external_reference": "external_reference",
          "investigation_status": "investigation_status",
          "mitre_techniques": "mitre_techniques",
          "tags": "detection_tags"
        },
        "description": "This query creates a Microsoft Sentinel incident when a detection on an account entity has been escalated in Vectra\n(investigation_status = escalated). Escalation indicates that a human analyst or MDR service\nhas reviewed the detection and determined it requires immediate customer attention or notification.\nOne incident is created per detection - grouping is based on alert display name so that\nrepeated rule evaluations against the same detection do not create duplicate incidents.\n\nThis query creates a Microsoft Sentinel incident when Vectra AI identifies an account entity with one or more detections\nmarked as unresolved and prioritized (unresolved_priority = true). Vectra's AI engine assigns\npriority based on attack rating, velocity, breadth, and identity privilege level. This rule surfaces\naccount-based threats that require analyst attention.\n\nIncidents are grouped per account entity and remain open while the threat persists. Once all associated\ndetections are resolved in Vectra, the incident can be closed in Microsoft Sentinel.\n",
        "displayName": "Vectra RUX - Create Incident for Escalated Account Detection or Unresolved Priority Account",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "entity_name",
                "identifier": "Name"
              },
              {
                "columnName": "entity_uid",
                "identifier": "UPNSuffix"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByAlertDetails": [
              "DisplayName"
            ],
            "groupByEntities": [
              "Account"
            ],
            "lookbackDuration": "P7D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra%20XDR/Analytic%20Rules/Vectra_RUX_Incident_Detection_Account.yaml",
        "query": "VectraDetectionsCombined\n| where [\"Entity Type\"] == \"account\"\n| summarize arg_max(TimeGenerated, *) by [\"Detection ID\"]\n| where [\"Investigation Status\"] == \"escalated\" or [\"Unresolved Priority\"] == true\n| extend\n    detection_name     = [\"D Type Vname\"],\n    detection_category = [\"Detection Category\"],\n    entity_url         = replace_string(replace_string(URL, \"api/v3.4/\", \"\"), \"api/v3.5/\", \"\"),\n    mitre_techniques   = tostring(Mitre),\n    detection_tags     = tostring(Tags),\n    assigned_to        = [\"Assigned To\"],\n    entity_name = [\"Entity Name\"],\n    entity_uid = [\"Entity UID\"],\n    entity_id = [\"Entity ID\"],\n    detection_id = [\"Detection ID\"],\n    external_reference = [\"External Reference ID\"],\n    investigation_status = [\"Investigation Status\"],\n    entity_type = [\"Entity Type\"]\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CommandAndControl",
          "CredentialAccess",
          "Discovery",
          "Exfiltration",
          "LateralMovement",
          "Persistence"
        ],
        "techniques": [
          "T1003",
          "T1041",
          "T1071",
          "T1078",
          "T1110"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}