VectraDetections
| where Type == "host"
| extend
entity_uid = ['Entity UID'],
entity_id = ['Entity ID'],
entity_type = ['Entity Type'],
detection_id = ['Detection ID'],
detection = ['Detection Name'],
category = ['Detection Category'],
detection_url = ['Vectra Pivot'],
mitre = Mitre,
tags = Tags
| summarize arg_max(TimeGenerated, *) by ['Detection ID'], entity_uid
description: This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monitored by the Vectra Platform
tactics:
- Persistence
triggerThreshold: 0
requiredDataConnectors:
- connectorId: VectraXDR
dataTypes:
- Detections_Data_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Vectra XDR/Analytic Rules/Detection_Host.yaml
customDetails:
entity_type: entity_type
entity_id: entity_id
mitre_techniques: mitre
tags: tags
detection_id: detection_id
eventGroupingSettings:
aggregationKind: AlertPerResult
incidentConfiguration:
createIncident: false
groupingConfiguration:
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
lookbackDuration: PT5H
alertDetailsOverride:
alertDynamicProperties:
- value: detection_url
alertProperty: AlertLink
alertDescriptionFormat: Vectra AI has detected {{category}} - {{detection}} on entity {{entity_uid}}.
alertDisplayNameFormat: Vectra AI Detection- {{detection}}
queryPeriod: 10m
entityMappings:
- entityType: Host
fieldMappings:
- columnName: entity_uid
identifier: HostName
relevantTechniques:
- T1546
status: Available
triggerOperator: GreaterThan
suppressionDuration: PT1H
id: fb861539-da19-4266-831f-99459b8e7605
suppressionEnabled: false
version: 1.0.1
kind: Scheduled
name: Vectra Create Detection Alert for Hosts
queryFrequency: 10m
query: |
VectraDetections
| where Type == "host"
| extend
entity_uid = ['Entity UID'],
entity_id = ['Entity ID'],
entity_type = ['Entity Type'],
detection_id = ['Detection ID'],
detection = ['Detection Name'],
category = ['Detection Category'],
detection_url = ['Vectra Pivot'],
mitre = Mitre,
tags = Tags
| summarize arg_max(TimeGenerated, *) by ['Detection ID'], entity_uid
severity: Medium
