Guardian- Sentiment Policy Violation Detection

Guardian
| where PolicyViolatedControlFeature =~ 'Sentiment'
| where Severity =~ 'Low'

triggerThreshold: 0
query: |
  Guardian
  | where PolicyViolatedControlFeature =~ 'Sentiment'
  | where Severity =~ 'Low'  
eventGroupingSettings:
  aggregationKind: SingleAlert
requiredDataConnectors:
- connectorId: BoschAIShield
  dataTypes:
  - Guardian
id: 24538989-9dea-4cc7-aa78-0969ca116051
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: NTDomain
    columnName: NTDomain
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIP
alertDetailsOverride:
  alertDisplayNameFormat: Guardian- Sentiment Policy Violation detection
  alertDescriptionFormat: |
        This query detects Sentiment Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
  alertTacticsColumnName: 
  alertSeverityColumnName: Severity
queryPeriod: 1h
severity: Low
queryFrequency: 1h
triggerOperator: gt
name: Guardian- Sentiment Policy Violation Detection
relevantTechniques: []
tactics: []
description: |
    'This alert creates an incident when Sentiment Policy Violation detected from the Guardian.'
kind: Scheduled
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/SentimentVulDetection.yaml
version: 1.0.0