BitSight - compromised systems detected

let timeframe = 24h;
BitSightFindingsData
| where ingestion_time() > ago(timeframe)
| where RiskCategory == "Compromised Systems"
| extend Severity = toreal(Severity)
| extend Severity = case( Severity <= 6.9 and Severity >= 4.0, "Low",
                          Severity <= 8.9 and Severity >= 7.0, "Medium",
                          Severity <= 10.0 and Severity >= 9.0, "High",
                          "Informational")
| project FirstSeen, CompanyName, Severity, RiskCategory, RiskVector, TemporaryId

alertDetailsOverride:
  alertDescriptionFormat: 'Alert is generated for {{CompanyName}}.\n\nRisk Vector: {{RiskVector}}\nTemporaryId: {{TemporaryId}}\nRisk Category: Compromised Systems'
  alertSeverityColumnName: Severity
  alertDisplayNameFormat: 'BitSight: Alert for {{RiskVector}} in {{CompanyName}} from BitSight'
id: d68b758a-b117-4cb8-8e1d-dcab5a4a2f21
name: BitSight - compromised systems detected
entityMappings:
- entityType: Malware
  fieldMappings:
  - columnName: RiskVector
    identifier: Name
  - columnName: RiskCategory
    identifier: Category
version: 1.0.2
queryFrequency: 1d
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
incidentConfiguration:
  createIncident: true
triggerThreshold: 0
kind: Scheduled
relevantTechniques:
- T1203
triggerOperator: GreaterThan
queryPeriod: 24h
severity: Medium
tactics:
- Execution
description: |
    'Rule helps to detect whenever there is a compromised systems found in BitSight.'
query: |
  let timeframe = 24h;
  BitSightFindingsData
  | where ingestion_time() > ago(timeframe)
  | where RiskCategory == "Compromised Systems"
  | extend Severity = toreal(Severity)
  | extend Severity = case( Severity <= 6.9 and Severity >= 4.0, "Low",
                            Severity <= 8.9 and Severity >= 7.0, "Medium",
                            Severity <= 10.0 and Severity >= 9.0, "High",
                            "Informational")
  | project FirstSeen, CompanyName, Severity, RiskCategory, RiskVector, TemporaryId  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BitSight/Analytic Rules/BitSightCompromisedSystemsDetected.yaml
requiredDataConnectors:
- connectorId: BitSight
  dataTypes:
  - BitSightFindingsData