{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f6a7b8c9-d0e1-2345-fabc-456789012345')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f6a7b8c9-d0e1-2345-fabc-456789012345')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "Relevance: {{RelevanceLevel}}\n\nWhy it matches your organisation:\n{{RelevanceReasoning}}\n\nSummary: {{AiSummary}}\n",
          "alertDisplayNameFormat": "GTI High Relevance Alert: {{AlertName}}"
        },
        "alertRuleTemplateName": "f6a7b8c9-d0e1-2345-fabc-456789012345",
        "customDetails": {
          "AlertId": "AlertId",
          "AlertState": "AlertState",
          "DetailType": "DetailType",
          "FindingCount": "FindingCount",
          "PriorityLevel": "PriorityLevel",
          "RelevanceConfidence": "RelevanceConfidence",
          "RelevanceLevel": "RelevanceLevel",
          "SeverityLevel": "SeverityLevel"
        },
        "description": "Triggers an incident when a GTI Relevance System Alert is assessed as RELEVANCE_LEVEL_HIGH\nwith a HIGH confidence level. High relevance means Google Threat Intelligence has determined\nthe threat directly or very closely matches your organisation profile - regardless of threat type.\nThese are the most actionable alerts and warrant priority investigation.\nEach unique Alert ID is grouped into a single incident.\n",
        "displayName": "GTI - High Relevance Alert Detected",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "AlertId"
            ],
            "lookbackDuration": "P5D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/RelevanceSystemAlerts/GTI_HighRelevanceAlerts.yaml",
        "query": "GTIRelevanceSystemAlerts\n| where RelevanceLevel == \"HIGH\"\n    and IsRelevant == true\n| extend\n    DetailSeverity = coalesce(DataLeakSeverity, InsiderThreatSeverity, InitialAccessBrokerSeverity, \"\")\n| project\n    TimeGenerated,\n    AlertId,\n    AlertName           = DisplayName,\n    AlertState          = State,\n    DetailType,\n    DetailSeverity,\n    RelevanceLevel,\n    RelevanceConfidence,\n    RelevanceReasoning,\n    CommonThemes        = RelevanceEvidenceCommonThemes,\n    DistinctThemes      = RelevanceEvidenceDistinctThemes,\n    SeverityLevel,\n    SeverityConfidence,\n    SeverityReasoning,\n    PriorityLevel,\n    PriorityReasoning,\n    FindingCount,\n    AiSummary,\n    AuditCreateTime,\n    AuditUpdateTime\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "Exfiltration",
          "Impact",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1068",
          "T1078",
          "T1486",
          "T1552",
          "T1566",
          "T1567"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}