Defender Alert Evidence

Back


Id	8138863e-e55f-4f02-ac94-72796e203d27
Rulename	Defender Alert Evidence
Description	This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.
Severity	High
Tactics	Persistence
Techniques	T1546
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	60m
Query period	60m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra XDR/Analytic Rules/Defender_Alert_Evidence.yaml
Version	1.0.0
Arm template	8138863e-e55f-4f02-ac94-72796e203d27.json

KQL

AlertEvidence
| where EntityType in ("Device", "User")

YAML

query: |
  AlertEvidence
  | where EntityType in ("Device", "User")  
status: Available
suppressionEnabled: false
queryPeriod: 60m
triggerOperator: GreaterThan
suppressionDuration: PT5H
eventGroupingSettings:
  aggregationKind: SingleAlert
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra XDR/Analytic Rules/Defender_Alert_Evidence.yaml
description: This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.
tactics:
- Persistence
triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: LocalIP
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: DeviceName
type: Microsoft.OperationalInsights/workspaces/providers/alertRules
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertEvidence
kind: Scheduled
relevantTechniques:
- T1546
queryFrequency: 60m
version: 1.0.0
incidentConfiguration:
  groupingConfiguration:
    matchingMethod: AllEntities
    reopenClosedIncident: false
    lookbackDuration: PT5H
    enabled: false
  createIncident: false
name: Defender Alert Evidence
id: 8138863e-e55f-4f02-ac94-72796e203d27
severity: High

ARM