{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/d4e5f6a7-b8c9-0123-defa-234567890124')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/d4e5f6a7-b8c9-0123-defa-234567890124')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Leak Severity: {{LeakSeverity}} | Priority: {{PriorityLevel}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI Data Leak: {{AlertName}}"
        },
        "alertRuleTemplateName": "d4e5f6a7-b8c9-0123-defa-234567890124",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "FindingCount": "FindingCount",
          "LeakSeverity": "LeakSeverity",
          "PriorityLevel": "PriorityLevel",
          "RelevanceLevel": "RelevanceLevel",
          "SeverityLevel": "SeverityLevel"
        },
        "description": "Triggers an incident when a GTI Relevance System Alert of type data_leak is ingested.\nData Leak alerts indicate that sensitive organisational data (credentials, PII, intellectual property,\nsource code, databases, etc.) has been found exposed on the dark web, paste sites, or underground\nforums and matches your organisation profile.\nEach unique Alert ID is grouped into a single incident.\n",
        "displayName": "GTI - Data Leak Alert Detected",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_DataLeakAlerts.yaml",
        "query": "GTIRelevanceSystemAlerts\n| where DetailType == \"data_leak\"\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName          = DisplayName,\n    AlertState         = State,\n    LeakSeverity       = DataLeakSeverity,\n    DiscoveryDocuments = DataLeakDiscoveryDocumentIds,\n    PriorityLevel,\n    PriorityReasoning,\n    SeverityLevel,\n    SeverityConfidence,\n    SeverityReasoning,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    FindingCount,\n    AiSummary,\n    CommonThemes       = RelevanceEvidenceCommonThemes,\n    DistinctThemes     = RelevanceEvidenceDistinctThemes,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Collection",
          "CredentialAccess",
          "Exfiltration",
          "Impact"
        ],
        "techniques": [
          "T1485",
          "T1530",
          "T1552",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}