Detection rules › Kusto
Generate alerts based on ExtraHop detections recommended for triage
'This analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546 Event Triggered Execution |
Rule body kusto
id: "cd65aebc-7e85-4cbb-9f91-ff0376c5d37d"
name: "Generate alerts based on ExtraHop detections recommended for triage"
description: |
'This analytics rule will generate alerts in Microsoft Sentinel for detections from ExtraHop that are recommended for triage.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: ExtraHop
dataTypes:
- ExtraHopDetections
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: GreaterThan
triggerThreshold: 0
tactics:
- Persistence
relevantTechniques:
- T1546
query: |
ExtraHopDetections
| where IsRecommended == true
incidentConfiguration:
createIncident: false
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: "Alert from {{EventVendor}} for Detection {{Title}}"
alertDescriptionFormat: "Alert from {{EventVendor}} for Detection {{Title}} for Id {{Id}}"
alertTacticsColumnName: "TacticNames"
alertSeverityColumnName: "Severity"
alertDynamicProperties:
- alertProperty: AlertLink
value: Url
- alertProperty: Techniques
value: TechniqueIds
- alertProperty: ProductName
value: EventVendor
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: SourceHostname
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: DestinationHostname
- entityType: IP
fieldMappings:
- identifier: Address
columnName: SourceIpAddress
- entityType: IP
fieldMappings:
- identifier: Address
columnName: DestinationIpAddress
- entityType: Account
fieldMappings:
- identifier: Name
columnName: SourceUsername
- entityType: Account
fieldMappings:
- identifier: Name
columnName: DestinationUsername
version: 1.0.2
kind: Scheduled
Stages and Predicates
Stage 1: source
ExtraHopDetections
Stage 2: where
| where IsRecommended == true
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
IsRecommended | eq |
|