Anvilogic_Alerts_CL | where avl_rule_mode!='Warn'
queryPeriod: 5m
query: |
Anvilogic_Alerts_CL | where avl_rule_mode!='Warn'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Anvilogic/Analytic Rules/Anvilogic_Alerts.yaml
name: Anvilogic Alert
entityMappings:
- fieldMappings:
- columnName: coi_account
identifier: Name
- columnName: src_nt_domain
identifier: NTDomain
- columnName: ssid
identifier: Sid
entityType: Account
- fieldMappings:
- columnName: coi_host
identifier: HostName
entityType: Host
- fieldMappings:
- columnName: coi_ip
identifier: Address
entityType: IP
- fieldMappings:
- columnName: url
identifier: Url
entityType: URL
- fieldMappings:
- columnName: coi_app
identifier: Name
entityType: CloudApplication
- fieldMappings:
- columnName: file_name
identifier: Name
- columnName: file_path
identifier: Directory
entityType: File
- fieldMappings:
- columnName: process_id
identifier: ProcessId
- columnName: process_exec
identifier: CommandLine
entityType: Process
- fieldMappings:
- columnName: registry_hive
identifier: Hive
- columnName: registry_key_name
identifier: Key
entityType: RegistryKey
- fieldMappings:
- columnName: registry_value_name
identifier: Name
- columnName: registry_value_data
identifier: Value
- columnName: registry_value_type
identifier: ValueType
entityType: RegistryValue
suppressionDuration: 1h
queryFrequency: 5m
suppressionEnabled: false
alertDetailsOverride:
alertDisplayNameFormat: '{{avl_rule_id}} - {{avl_use_case_title}} - {{avl_use_case_type}}'
alertDynamicProperties:
- value: avl_mitre_technique
alertProperty: Techniques
alertDescriptionFormat: |-
avl_rule_id: {{avl_rule_id}}
{{avl_definition}}
alertTacticsColumnName: avl_mitre_tactic
description: |
'Alert generated by Anvilogic.'
kind: Scheduled
incidentConfiguration:
groupingConfiguration:
lookbackDuration: PT5M
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
createIncident: true
version: 1.0.1
eventGroupingSettings:
aggregationKind: AlertPerResult
status: Available
severity: Medium
requiredDataConnectors:
- connectorId: Anvilogic
dataTypes:
- Anvilogic_Alerts_CL
triggerOperator: gt
triggerThreshold: 0
customDetails:
techniques: avl_mitre_technique
raw: raw
tactics: avl_mitre_tactic
tactics: []
id: 6ccc187a-42ee-4635-8bcc-3b299f8570df
relevantTechniques: []
