Anvilogic_Alerts_CL | where avl_rule_mode!='Warn'
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: coi_account
- identifier: NTDomain
columnName: src_nt_domain
- identifier: Sid
columnName: ssid
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: coi_host
- entityType: IP
fieldMappings:
- identifier: Address
columnName: coi_ip
- entityType: URL
fieldMappings:
- identifier: Url
columnName: url
- entityType: CloudApplication
fieldMappings:
- identifier: Name
columnName: coi_app
- entityType: File
fieldMappings:
- identifier: Name
columnName: file_name
- identifier: Directory
columnName: file_path
- entityType: Process
fieldMappings:
- identifier: ProcessId
columnName: process_id
- identifier: CommandLine
columnName: process_exec
- entityType: RegistryKey
fieldMappings:
- identifier: Hive
columnName: registry_hive
- identifier: Key
columnName: registry_key_name
- entityType: RegistryValue
fieldMappings:
- identifier: Name
columnName: registry_value_name
- identifier: Value
columnName: registry_value_data
- identifier: ValueType
columnName: registry_value_type
tactics: []
suppressionEnabled: false
suppressionDuration: 1h
requiredDataConnectors:
- dataTypes:
- Anvilogic_Alerts_CL
connectorId: Anvilogic
alertDetailsOverride:
alertDisplayNameFormat: '{{avl_rule_id}} - {{avl_use_case_title}} - {{avl_use_case_type}}'
alertDescriptionFormat: |-
avl_rule_id: {{avl_rule_id}}
{{avl_definition}}
alertTacticsColumnName: avl_mitre_tactic
alertDynamicProperties:
- value: avl_mitre_technique
alertProperty: Techniques
incidentConfiguration:
groupingConfiguration:
enabled: false
lookbackDuration: PT5M
reopenClosedIncident: false
matchingMethod: AllEntities
createIncident: true
id: 6ccc187a-42ee-4635-8bcc-3b299f8570df
severity: Medium
eventGroupingSettings:
aggregationKind: AlertPerResult
status: Available
customDetails:
tactics: avl_mitre_tactic
raw: raw
techniques: avl_mitre_technique
query: |
Anvilogic_Alerts_CL | where avl_rule_mode!='Warn'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Anvilogic/Analytic Rules/Anvilogic_Alerts.yaml
kind: Scheduled
queryPeriod: 5m
version: 1.0.1
name: Anvilogic Alert
queryFrequency: 5m
triggerThreshold: 0
relevantTechniques: []
description: |
'Alert generated by Anvilogic.'
triggerOperator: gt
