Guardian
| where PolicyViolatedControlFeature =~ 'Block Competitor'
| where Severity =~ 'Low'
description: |
'This alert creates an incident when a Block Competitor Policy Violation is detected from the Guardian.'
queryFrequency: 1h
status: Available
kind: Scheduled
relevantTechniques: []
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AIShield AI Security Monitoring/Analytic Rules/BlockCompetitorVulDetection.yaml
requiredDataConnectors:
- connectorId: BoschAIShield
dataTypes:
- Guardian
id: e5d9eea1-3250-49ba-9e39-b5678ec7496b
severity: Low
query: |
Guardian
| where PolicyViolatedControlFeature =~ 'Block Competitor'
| where Severity =~ 'Low'
tactics: []
alertDetailsOverride:
alertDisplayNameFormat: Guardian- Block Competitor Policy Violation detection
alertSeverityColumnName: Severity
alertDescriptionFormat: |
This query detects Block Competitor Policy Violation detected from the Guardian generated at {{TimeGenerated}}.\n\nPlease check the source for more information and investigate further.
alertTacticsColumnName:
entityMappings:
- entityType: Host
fieldMappings:
- columnName: HostName
identifier: HostName
- columnName: NTDomain
identifier: NTDomain
- entityType: IP
fieldMappings:
- columnName: SourceIP
identifier: Address
triggerThreshold: 0
eventGroupingSettings:
aggregationKind: SingleAlert
queryPeriod: 1h
name: Guardian- Block Competitor Policy Violation Detection
triggerOperator: gt
version: 1.0.0
