Cayosoft Guardian - Core Identity and Infrastructure Threats

// ATTENTION: ruleFrequency must match the "queryFrequency" value in the rule's scheduling settings!
// ATTENTION: lookbackPeriod must match the "queryPeriod" value in the rule's scheduling settings!
// If you change one, change both, in every location, or you will reintroduce duplicate alerts.
// Pattern reference: https://learn.microsoft.com/en-us/azure/sentinel/ingestion-delay
let ruleFrequency = 1h;
let lookbackPeriod = 1d;
let window_end = bin(now(), ruleFrequency);      
let window_start = window_end - ruleFrequency;   
CayosoftThreatAlerts_CL
| where TimeGenerated >= ago(lookbackPeriod)
| where ingestion_time() > window_start and ingestion_time() <= window_end
| extend ParsedCategories = todynamic(Categories)
| extend TargetObjectTypeNormalized = tostring(TargetObjectType)
| extend TargetLocationNormalized = tostring(TargetLocation)
| mv-apply Cat = ParsedCategories on (
    summarize Values = make_list(tostring(Cat.value)) by Key = iff(tostring(Cat.name) startswith 'MITRE ATT', 'MITRE ATT&CK', tostring(Cat.name))
| summarize CleanCategories = make_bag(pack(Key, strcat_array(Values, ', ')))
    )
| extend Tactics = iff(isnotempty(CleanCategories['Attack tactics']), split(replace_string(tostring(CleanCategories['Attack tactics']), ' ', ''), ','), dynamic([]))
| extend Techniques = iff(isnotempty(CleanCategories['MITRE ATT&CK']), extract_all(@"(T\d{4})", tostring(CleanCategories['MITRE ATT&CK'])), dynamic([]))
| extend ExtractedDomain = tostring(split(TargetLocationNormalized, '/')[0])
| extend IsEntra = TargetObjectTypeNormalized startswith 'microsoft.graph'
| extend IsAD = TargetObjectTypeNormalized startswith 'microsoft.ad' or TargetObjectTypeNormalized has 'ServiceAccount'
| extend IsGMSA = TargetObjectTypeNormalized contains 'ManagedServiceAccount'
| extend ParsedUser = case(
    TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'ServiceAccount' or TargetObjectTypeNormalized has 'inetOrgPerson', TargetObjectName,
    extract("member\\s+'([^']+)'", 1, Subject)
    )
| extend TargetAccountAadUserId = iff(IsEntra and TargetObjectTypeNormalized has 'user', TargetObjectId, dynamic(null))
| extend TargetAccountName = case(
    IsEntra and TargetObjectTypeNormalized has 'user', iff(ParsedUser contains '@', tostring(split(ParsedUser, '@')[0]), ParsedUser),
    IsAD and (TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'foreignSecurityPrincipal' or IsGMSA), TargetObjectName,
    IsAD and TargetObjectTypeNormalized has 'directoryObject', TargetObjectName,
    isnotempty(ParsedUser), iff(ParsedUser contains '@', tostring(split(ParsedUser, '@')[0]), ParsedUser),
    dynamic(null)
    )
| extend TargetAccountObjectGuid = iff(IsAD and (TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'foreignSecurityPrincipal' or IsGMSA), TargetObjectId, dynamic(null))
| extend TargetHostName = iff(TargetObjectTypeNormalized has 'computer' or TargetObjectTypeNormalized has 'device', TargetObjectName, dynamic(null))
| extend TargetHostDomain = iff(IsAD and TargetObjectTypeNormalized has 'computer', ExtractedDomain, dynamic(null))
| extend TargetHostAzureID = iff(IsEntra and TargetObjectTypeNormalized has 'device', TargetObjectId, dynamic(null))
| extend RawPath = iff(TargetLocationNormalized contains '/', substring(TargetLocationNormalized, indexof(TargetLocationNormalized, '/') + 1), '')
// Convert domain
| extend DomainDN = strcat('DC=', replace_string(ExtractedDomain, '.', ',DC='))
// Smart path processing
| extend PathDN = case(
    isempty(RawPath), '',
    RawPath has_any ('Builtin', 'Users', 'Computers', 'ForeignSecurityPrincipals', 'Managed Service Accounts'), strcat('CN=', replace_string(RawPath, '/', ',CN=')),
    strcat('OU=', replace_string(RawPath, '/', ',OU='))
)
// Assemble the final DistinguishedName and Name for the group
| extend TargetGroupName = iff(TargetObjectTypeNormalized has 'group', TargetObjectName, dynamic(null))
| extend TargetGroupDistinguishedName = iff(
    TargetObjectTypeNormalized has 'group', 
    strcat('CN=', TargetObjectName, iff(isnotempty(PathDN), strcat(',', PathDN), ''), ',', DomainDN), 
    dynamic(null)
)
| extend TargetGroupObjectGuid = iff(TargetObjectTypeNormalized has 'group', TargetObjectId, dynamic(null))
| extend TargetDNSName = case(
    IsAD and TargetObjectTypeNormalized has 'trustedDomain', TargetObjectName,
    isnotempty(TargetLocationNormalized), ExtractedDomain,
    dynamic(null)
    )
| extend ThreatDocUrl = tolower( strcat('https://www.cayosoft.com/threat-directory/', ThreatId, '/'))
| extend AlertSeverity = case(
    Severity == 'high', 'High',
    Severity == 'medium', 'Medium',
    Severity == 'low', 'Low',
    Severity == 'informational', 'Informational',
    'Informational'
    )
| project-away Categories, ParsedCategories
| project-rename Categories = CleanCategories
| where not(IsEntra and (TargetObjectType has 'application' or TargetObjectType has 'servicePrincipal'))

suppressionDuration: 1h
name: Cayosoft Guardian - Core Identity and Infrastructure Threats
suppressionEnabled: false
triggerOperator: gt
query: |
  // ATTENTION: ruleFrequency must match the "queryFrequency" value in the rule's scheduling settings!
  // ATTENTION: lookbackPeriod must match the "queryPeriod" value in the rule's scheduling settings!
  // If you change one, change both, in every location, or you will reintroduce duplicate alerts.
  // Pattern reference: https://learn.microsoft.com/en-us/azure/sentinel/ingestion-delay
  let ruleFrequency = 1h;
  let lookbackPeriod = 1d;
  let window_end = bin(now(), ruleFrequency);      
  let window_start = window_end - ruleFrequency;   
  CayosoftThreatAlerts_CL
  | where TimeGenerated >= ago(lookbackPeriod)
  | where ingestion_time() > window_start and ingestion_time() <= window_end
  | extend ParsedCategories = todynamic(Categories)
  | extend TargetObjectTypeNormalized = tostring(TargetObjectType)
  | extend TargetLocationNormalized = tostring(TargetLocation)
  | mv-apply Cat = ParsedCategories on (
      summarize Values = make_list(tostring(Cat.value)) by Key = iff(tostring(Cat.name) startswith 'MITRE ATT', 'MITRE ATT&CK', tostring(Cat.name))
  | summarize CleanCategories = make_bag(pack(Key, strcat_array(Values, ', ')))
      )
  | extend Tactics = iff(isnotempty(CleanCategories['Attack tactics']), split(replace_string(tostring(CleanCategories['Attack tactics']), ' ', ''), ','), dynamic([]))
  | extend Techniques = iff(isnotempty(CleanCategories['MITRE ATT&CK']), extract_all(@"(T\d{4})", tostring(CleanCategories['MITRE ATT&CK'])), dynamic([]))
  | extend ExtractedDomain = tostring(split(TargetLocationNormalized, '/')[0])
  | extend IsEntra = TargetObjectTypeNormalized startswith 'microsoft.graph'
  | extend IsAD = TargetObjectTypeNormalized startswith 'microsoft.ad' or TargetObjectTypeNormalized has 'ServiceAccount'
  | extend IsGMSA = TargetObjectTypeNormalized contains 'ManagedServiceAccount'
  | extend ParsedUser = case(
      TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'ServiceAccount' or TargetObjectTypeNormalized has 'inetOrgPerson', TargetObjectName,
      extract("member\\s+'([^']+)'", 1, Subject)
      )
  | extend TargetAccountAadUserId = iff(IsEntra and TargetObjectTypeNormalized has 'user', TargetObjectId, dynamic(null))
  | extend TargetAccountName = case(
      IsEntra and TargetObjectTypeNormalized has 'user', iff(ParsedUser contains '@', tostring(split(ParsedUser, '@')[0]), ParsedUser),
      IsAD and (TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'foreignSecurityPrincipal' or IsGMSA), TargetObjectName,
      IsAD and TargetObjectTypeNormalized has 'directoryObject', TargetObjectName,
      isnotempty(ParsedUser), iff(ParsedUser contains '@', tostring(split(ParsedUser, '@')[0]), ParsedUser),
      dynamic(null)
      )
  | extend TargetAccountObjectGuid = iff(IsAD and (TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'foreignSecurityPrincipal' or IsGMSA), TargetObjectId, dynamic(null))
  | extend TargetHostName = iff(TargetObjectTypeNormalized has 'computer' or TargetObjectTypeNormalized has 'device', TargetObjectName, dynamic(null))
  | extend TargetHostDomain = iff(IsAD and TargetObjectTypeNormalized has 'computer', ExtractedDomain, dynamic(null))
  | extend TargetHostAzureID = iff(IsEntra and TargetObjectTypeNormalized has 'device', TargetObjectId, dynamic(null))
  | extend RawPath = iff(TargetLocationNormalized contains '/', substring(TargetLocationNormalized, indexof(TargetLocationNormalized, '/') + 1), '')
  // Convert domain
  | extend DomainDN = strcat('DC=', replace_string(ExtractedDomain, '.', ',DC='))
  // Smart path processing
  | extend PathDN = case(
      isempty(RawPath), '',
      RawPath has_any ('Builtin', 'Users', 'Computers', 'ForeignSecurityPrincipals', 'Managed Service Accounts'), strcat('CN=', replace_string(RawPath, '/', ',CN=')),
      strcat('OU=', replace_string(RawPath, '/', ',OU='))
  )
  // Assemble the final DistinguishedName and Name for the group
  | extend TargetGroupName = iff(TargetObjectTypeNormalized has 'group', TargetObjectName, dynamic(null))
  | extend TargetGroupDistinguishedName = iff(
      TargetObjectTypeNormalized has 'group', 
      strcat('CN=', TargetObjectName, iff(isnotempty(PathDN), strcat(',', PathDN), ''), ',', DomainDN), 
      dynamic(null)
  )
  | extend TargetGroupObjectGuid = iff(TargetObjectTypeNormalized has 'group', TargetObjectId, dynamic(null))
  | extend TargetDNSName = case(
      IsAD and TargetObjectTypeNormalized has 'trustedDomain', TargetObjectName,
      isnotempty(TargetLocationNormalized), ExtractedDomain,
      dynamic(null)
      )
  | extend ThreatDocUrl = tolower( strcat('https://www.cayosoft.com/threat-directory/', ThreatId, '/'))
  | extend AlertSeverity = case(
      Severity == 'high', 'High',
      Severity == 'medium', 'Medium',
      Severity == 'low', 'Low',
      Severity == 'informational', 'Informational',
      'Informational'
      )
  | project-away Categories, ParsedCategories
  | project-rename Categories = CleanCategories
  | where not(IsEntra and (TargetObjectType has 'application' or TargetObjectType has 'servicePrincipal'))
queryFrequency: 1h
description: |
  Creates Microsoft Sentinel incidents for identity and infrastructure security threats reported by Cayosoft Guardian across on-premises Active Directory and Microsoft Entra ID. This includes threats related to accounts, service accounts, computers, security groups, and trusted domains. Incident severity is determined dynamically based on the severity of the detected threat.

  This rule complements the Cloud Application Security Threats rule, which covers cloud application and service principal threat alerts not included in this rule.

  Alerts with the same Cayosoft ThreatId are grouped into a single incident within a 1-day lookback window. Each alert includes a link to the Cayosoft Threat Directory for guidance on remediation.
id: 4720d7a5-6845-4ce4-aa45-79334e1a1176
triggerThreshold: 0
queryPeriod: 1d
contentId: CayosoftGuardianMainAlerts
version: 1.0.0
kind: Scheduled
customDetails:
  Evidence: Evidence
  CreatedDateTime: CreatedDateTime
  Categories: Categories
  TargetType: TargetObjectType
  ThreatDocUrl: ThreatDocUrl
  TargetName: TargetObjectName
  Where: TargetLocation
  ThreatId: ThreatId
  RemediationComplex: RemediationComplexity
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: Medium
requiredDataConnectors:
- connectorId: CayosoftGuardianConnector
  dataTypes:
  - CayosoftThreatAlerts_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cayosoft%20Guardian/Analytic%20Rules/CayosoftGuardian-MainRule.yaml
incidentConfiguration:
  groupingConfiguration:
    groupByCustomDetails:
    - ThreatId
    lookbackDuration: P1D
    enabled: true
    reopenClosedIncident: false
    matchingMethod: Selected
  createIncident: true
alertDetailsOverride:
  alertDynamicProperties:
  - value: ThreatDocUrl
    alertProperty: AlertLink
  - value: Techniques
    alertProperty: Techniques
  alertDisplayNameFormat: '{{Subject}}'
  alertTacticsColumnName: Tactics
  alertSeverityColumnName: AlertSeverity
  alertDescriptionFormat: 'Details: {{ThreatDocUrl}}'
relevantTechniques: []
tactics: []
entityMappings:
- fieldMappings:
  - identifier: AadUserId
    columnName: TargetAccountAadUserId
  - identifier: Name
    columnName: TargetAccountName
  - identifier: ObjectGuid
    columnName: TargetAccountObjectGuid
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: TargetHostName
  - identifier: NTDomain
    columnName: TargetHostDomain
  - identifier: AzureID
    columnName: TargetHostAzureID
  entityType: Host
- fieldMappings:
  - identifier: DistinguishedName
    columnName: TargetGroupDistinguishedName
  - identifier: ObjectGuid
    columnName: TargetGroupObjectGuid
  entityType: SecurityGroup
- fieldMappings:
  - identifier: DomainName
    columnName: TargetDNSName
  entityType: DNS

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/4720d7a5-6845-4ce4-aa45-79334e1a1176')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/4720d7a5-6845-4ce4-aa45-79334e1a1176')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Details: {{ThreatDocUrl}}",
          "alertDisplayNameFormat": "{{Subject}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "ThreatDocUrl"
            },
            {
              "alertProperty": "Techniques",
              "value": "Techniques"
            }
          ],
          "alertSeverityColumnName": "AlertSeverity",
          "alertTacticsColumnName": "Tactics"
        },
        "alertRuleTemplateName": "4720d7a5-6845-4ce4-aa45-79334e1a1176",
        "contentId": "CayosoftGuardianMainAlerts",
        "customDetails": {
          "Categories": "Categories",
          "CreatedDateTime": "CreatedDateTime",
          "Evidence": "Evidence",
          "RemediationComplex": "RemediationComplexity",
          "TargetName": "TargetObjectName",
          "TargetType": "TargetObjectType",
          "ThreatDocUrl": "ThreatDocUrl",
          "ThreatId": "ThreatId",
          "Where": "TargetLocation"
        },
        "description": "Creates Microsoft Sentinel incidents for identity and infrastructure security threats reported by Cayosoft Guardian across on-premises Active Directory and Microsoft Entra ID. This includes threats related to accounts, service accounts, computers, security groups, and trusted domains. Incident severity is determined dynamically based on the severity of the detected threat.\n\nThis rule complements the Cloud Application Security Threats rule, which covers cloud application and service principal threat alerts not included in this rule.\n\nAlerts with the same Cayosoft ThreatId are grouped into a single incident within a 1-day lookback window. Each alert includes a link to the Cayosoft Threat Directory for guidance on remediation.\n",
        "displayName": "Cayosoft Guardian - Core Identity and Infrastructure Threats",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "TargetAccountAadUserId",
                "identifier": "AadUserId"
              },
              {
                "columnName": "TargetAccountName",
                "identifier": "Name"
              },
              {
                "columnName": "TargetAccountObjectGuid",
                "identifier": "ObjectGuid"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "TargetHostName",
                "identifier": "HostName"
              },
              {
                "columnName": "TargetHostDomain",
                "identifier": "NTDomain"
              },
              {
                "columnName": "TargetHostAzureID",
                "identifier": "AzureID"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "columnName": "TargetGroupDistinguishedName",
                "identifier": "DistinguishedName"
              },
              {
                "columnName": "TargetGroupObjectGuid",
                "identifier": "ObjectGuid"
              }
            ]
          },
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "TargetDNSName",
                "identifier": "DomainName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "ThreatId"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cayosoft%20Guardian/Analytic%20Rules/CayosoftGuardian-MainRule.yaml",
        "query": "// ATTENTION: ruleFrequency must match the \"queryFrequency\" value in the rule's scheduling settings!\n// ATTENTION: lookbackPeriod must match the \"queryPeriod\" value in the rule's scheduling settings!\n// If you change one, change both, in every location, or you will reintroduce duplicate alerts.\n// Pattern reference: https://learn.microsoft.com/en-us/azure/sentinel/ingestion-delay\nlet ruleFrequency = 1h;\nlet lookbackPeriod = 1d;\nlet window_end = bin(now(), ruleFrequency);      \nlet window_start = window_end - ruleFrequency;   \nCayosoftThreatAlerts_CL\n| where TimeGenerated >= ago(lookbackPeriod)\n| where ingestion_time() > window_start and ingestion_time() <= window_end\n| extend ParsedCategories = todynamic(Categories)\n| extend TargetObjectTypeNormalized = tostring(TargetObjectType)\n| extend TargetLocationNormalized = tostring(TargetLocation)\n| mv-apply Cat = ParsedCategories on (\n    summarize Values = make_list(tostring(Cat.value)) by Key = iff(tostring(Cat.name) startswith 'MITRE ATT', 'MITRE ATT&CK', tostring(Cat.name))\n| summarize CleanCategories = make_bag(pack(Key, strcat_array(Values, ', ')))\n    )\n| extend Tactics = iff(isnotempty(CleanCategories['Attack tactics']), split(replace_string(tostring(CleanCategories['Attack tactics']), ' ', ''), ','), dynamic([]))\n| extend Techniques = iff(isnotempty(CleanCategories['MITRE ATT&CK']), extract_all(@\"(T\\d{4})\", tostring(CleanCategories['MITRE ATT&CK'])), dynamic([]))\n| extend ExtractedDomain = tostring(split(TargetLocationNormalized, '/')[0])\n| extend IsEntra = TargetObjectTypeNormalized startswith 'microsoft.graph'\n| extend IsAD = TargetObjectTypeNormalized startswith 'microsoft.ad' or TargetObjectTypeNormalized has 'ServiceAccount'\n| extend IsGMSA = TargetObjectTypeNormalized contains 'ManagedServiceAccount'\n| extend ParsedUser = case(\n    TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'ServiceAccount' or TargetObjectTypeNormalized has 'inetOrgPerson', TargetObjectName,\n    extract(\"member\\\\s+'([^']+)'\", 1, Subject)\n    )\n| extend TargetAccountAadUserId = iff(IsEntra and TargetObjectTypeNormalized has 'user', TargetObjectId, dynamic(null))\n| extend TargetAccountName = case(\n    IsEntra and TargetObjectTypeNormalized has 'user', iff(ParsedUser contains '@', tostring(split(ParsedUser, '@')[0]), ParsedUser),\n    IsAD and (TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'foreignSecurityPrincipal' or IsGMSA), TargetObjectName,\n    IsAD and TargetObjectTypeNormalized has 'directoryObject', TargetObjectName,\n    isnotempty(ParsedUser), iff(ParsedUser contains '@', tostring(split(ParsedUser, '@')[0]), ParsedUser),\n    dynamic(null)\n    )\n| extend TargetAccountObjectGuid = iff(IsAD and (TargetObjectTypeNormalized has 'user' or TargetObjectTypeNormalized has 'foreignSecurityPrincipal' or IsGMSA), TargetObjectId, dynamic(null))\n| extend TargetHostName = iff(TargetObjectTypeNormalized has 'computer' or TargetObjectTypeNormalized has 'device', TargetObjectName, dynamic(null))\n| extend TargetHostDomain = iff(IsAD and TargetObjectTypeNormalized has 'computer', ExtractedDomain, dynamic(null))\n| extend TargetHostAzureID = iff(IsEntra and TargetObjectTypeNormalized has 'device', TargetObjectId, dynamic(null))\n| extend RawPath = iff(TargetLocationNormalized contains '/', substring(TargetLocationNormalized, indexof(TargetLocationNormalized, '/') + 1), '')\n// Convert domain\n| extend DomainDN = strcat('DC=', replace_string(ExtractedDomain, '.', ',DC='))\n// Smart path processing\n| extend PathDN = case(\n    isempty(RawPath), '',\n    RawPath has_any ('Builtin', 'Users', 'Computers', 'ForeignSecurityPrincipals', 'Managed Service Accounts'), strcat('CN=', replace_string(RawPath, '/', ',CN=')),\n    strcat('OU=', replace_string(RawPath, '/', ',OU='))\n)\n// Assemble the final DistinguishedName and Name for the group\n| extend TargetGroupName = iff(TargetObjectTypeNormalized has 'group', TargetObjectName, dynamic(null))\n| extend TargetGroupDistinguishedName = iff(\n    TargetObjectTypeNormalized has 'group', \n    strcat('CN=', TargetObjectName, iff(isnotempty(PathDN), strcat(',', PathDN), ''), ',', DomainDN), \n    dynamic(null)\n)\n| extend TargetGroupObjectGuid = iff(TargetObjectTypeNormalized has 'group', TargetObjectId, dynamic(null))\n| extend TargetDNSName = case(\n    IsAD and TargetObjectTypeNormalized has 'trustedDomain', TargetObjectName,\n    isnotempty(TargetLocationNormalized), ExtractedDomain,\n    dynamic(null)\n    )\n| extend ThreatDocUrl = tolower( strcat('https://www.cayosoft.com/threat-directory/', ThreatId, '/'))\n| extend AlertSeverity = case(\n    Severity == 'high', 'High',\n    Severity == 'medium', 'Medium',\n    Severity == 'low', 'Low',\n    Severity == 'informational', 'Informational',\n    'Informational'\n    )\n| project-away Categories, ParsedCategories\n| project-rename Categories = CleanCategories\n| where not(IsEntra and (TargetObjectType has 'application' or TargetObjectType has 'servicePrincipal'))\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [],
        "techniques": [],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}