Anvilogic Alert

Anvilogic_Alerts_CL | where avl_rule_mode!='Warn'

name: Anvilogic Alert
relevantTechniques: []
id: 6ccc187a-42ee-4635-8bcc-3b299f8570df
suppressionEnabled: false
requiredDataConnectors:
- dataTypes:
  - Anvilogic_Alerts_CL
  connectorId: Anvilogic
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.1
severity: Medium
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Anvilogic/Analytic Rules/Anvilogic_Alerts.yaml
queryPeriod: 5m
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: coi_account
  - identifier: NTDomain
    columnName: src_nt_domain
  - identifier: Sid
    columnName: ssid
  entityType: Account
- fieldMappings:
  - identifier: HostName
    columnName: coi_host
  entityType: Host
- fieldMappings:
  - identifier: Address
    columnName: coi_ip
  entityType: IP
- fieldMappings:
  - identifier: Url
    columnName: url
  entityType: URL
- fieldMappings:
  - identifier: Name
    columnName: coi_app
  entityType: CloudApplication
- fieldMappings:
  - identifier: Name
    columnName: file_name
  - identifier: Directory
    columnName: file_path
  entityType: File
- fieldMappings:
  - identifier: ProcessId
    columnName: process_id
  - identifier: CommandLine
    columnName: process_exec
  entityType: Process
- fieldMappings:
  - identifier: Hive
    columnName: registry_hive
  - identifier: Key
    columnName: registry_key_name
  entityType: RegistryKey
- fieldMappings:
  - identifier: Name
    columnName: registry_value_name
  - identifier: Value
    columnName: registry_value_data
  - identifier: ValueType
    columnName: registry_value_type
  entityType: RegistryValue
kind: Scheduled
queryFrequency: 5m
incidentConfiguration:
  groupingConfiguration:
    reopenClosedIncident: false
    matchingMethod: AllEntities
    lookbackDuration: PT5M
    enabled: false
  createIncident: true
suppressionDuration: 1h
alertDetailsOverride:
  alertDisplayNameFormat: '{{avl_rule_id}} - {{avl_use_case_title}} - {{avl_use_case_type}}'
  alertDescriptionFormat: |-
    avl_rule_id: {{avl_rule_id}} 
    {{avl_definition}}    
  alertTacticsColumnName: avl_mitre_tactic
  alertDynamicProperties:
  - value: avl_mitre_technique
    alertProperty: Techniques
status: Available
query: |
    Anvilogic_Alerts_CL | where avl_rule_mode!='Warn'
tactics: []
customDetails:
  tactics: avl_mitre_tactic
  raw: raw
  techniques: avl_mitre_technique
description: |
    'Alert generated by Anvilogic.'
triggerOperator: gt