Vectra Create Detection Alert for Accounts

VectraDetections
| where Type == "account"
| extend
    entity_uid = ['Entity UID'],
    entity_id = ['Entity ID'],
    entity_type = ['Entity Type'],
    detection_id = ['Detection ID'],
    detection = ['Detection Name'],
    category = ['Detection Category'],
    detection_url = ['Vectra Pivot'],
    mitre = Mitre,
    tags = Tags
| summarize arg_max(TimeGenerated, *) by ['Detection ID'], entity_uid

incidentConfiguration:
  createIncident: false
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
    matchingMethod: AllEntities
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: entity_uid
    identifier: Name
query: |
  VectraDetections
  | where Type == "account"
  | extend
      entity_uid = ['Entity UID'],
      entity_id = ['Entity ID'],
      entity_type = ['Entity Type'],
      detection_id = ['Detection ID'],
      detection = ['Detection Name'],
      category = ['Detection Category'],
      detection_url = ['Vectra Pivot'],
      mitre = Mitre,
      tags = Tags
  | summarize arg_max(TimeGenerated, *) by ['Detection ID'], entity_uid
suppressionEnabled: false
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: e796701f-6b39-4c54-bf8a-1d543a990784
queryFrequency: 10m
alertDetailsOverride:
  alertDisplayNameFormat: Vectra AI Detection-  {{detection}}
  alertDescriptionFormat: Vectra AI has detected {{category}} - {{detection} on entity {{entity_uid}}.
  alertDynamicProperties:
  - value: detection_url
    alertProperty: AlertLink
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra%20XDR/Analytic%20Rules/Detection_Account.yaml
suppressionDuration: PT1H
severity: Medium
relevantTechniques:
- T1546
version: 1.0.1
kind: Scheduled
tactics:
- Persistence
requiredDataConnectors:
- dataTypes:
  - Detections_Data_CL
  connectorId: VectraXDR
description: This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monitored by the Vectra Platform
customDetails:
  entity_type: entity_type
  entity_id: entity_id
  mitre_techniques: mitre
  tags: tags
  detection_id: detection_id
triggerOperator: GreaterThan
name: Vectra Create Detection Alert for Accounts
triggerThreshold: 0
queryPeriod: 10m

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/e796701f-6b39-4c54-bf8a-1d543a990784')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e796701f-6b39-4c54-bf8a-1d543a990784')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Vectra AI has detected {{category}} - {{detection} on entity {{entity_uid}}.",
          "alertDisplayNameFormat": "Vectra AI Detection-  {{detection}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "AlertLink",
              "value": "detection_url"
            }
          ]
        },
        "alertRuleTemplateName": "e796701f-6b39-4c54-bf8a-1d543a990784",
        "customDetails": {
          "detection_id": "detection_id",
          "entity_id": "entity_id",
          "entity_type": "entity_type",
          "mitre_techniques": "mitre",
          "tags": "tags"
        },
        "description": "This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monitored by the Vectra Platform",
        "displayName": "Vectra Create Detection Alert for Accounts",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "entity_uid",
                "identifier": "Name"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": false,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra%20XDR/Analytic%20Rules/Detection_Account.yaml",
        "query": "VectraDetections\n| where Type == \"account\"\n| extend\n    entity_uid = ['Entity UID'],\n    entity_id = ['Entity ID'],\n    entity_type = ['Entity Type'],\n    detection_id = ['Detection ID'],\n    detection = ['Detection Name'],\n    category = ['Detection Category'],\n    detection_url = ['Vectra Pivot'],\n    mitre = Mitre,\n    tags = Tags\n| summarize arg_max(TimeGenerated, *) by ['Detection ID'], entity_uid\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence"
        ],
        "techniques": [
          "T1546"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}