Defender Alert Evidence

AlertEvidence
| where EntityType in ("Device", "User")

triggerThreshold: 0
name: Defender Alert Evidence
suppressionDuration: PT5H
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountName
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: LocalIP
  entityType: IP
- fieldMappings:
  - identifier: HostName
    columnName: DeviceName
  entityType: Host
suppressionEnabled: false
triggerOperator: GreaterThan
query: |
  AlertEvidence
  | where EntityType in ("Device", "User")
queryFrequency: 60m
description: This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.
id: 8138863e-e55f-4f02-ac94-72796e203d27
kind: Scheduled
queryPeriod: 60m
type: Microsoft.OperationalInsights/workspaces/providers/alertRules
status: Available
relevantTechniques:
- T1546
eventGroupingSettings:
  aggregationKind: SingleAlert
severity: High
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertEvidence
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra%20XDR/Analytic%20Rules/Defender_Alert_Evidence.yaml
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
  createIncident: false
tactics:
- Persistence
version: 1.0.0

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8138863e-e55f-4f02-ac94-72796e203d27')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8138863e-e55f-4f02-ac94-72796e203d27')]",
      "properties": {
        "alertRuleTemplateName": "8138863e-e55f-4f02-ac94-72796e203d27",
        "customDetails": null,
        "description": "This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.",
        "displayName": "Defender Alert Evidence",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "LocalIP",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "DeviceName",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": false,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra%20XDR/Analytic%20Rules/Defender_Alert_Evidence.yaml",
        "query": "AlertEvidence\n| where EntityType in (\"Device\", \"User\")\n",
        "queryFrequency": "PT60M",
        "queryPeriod": "PT60M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT5H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": [
          "T1546"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}