Detection rules › Kusto
Vectra Create Incident Based on Priority for Hosts
Create an incident when an identity is suspected to be compromised. Vectra is using AI to prioritize an entity based on multiple factors (attack rating, velocity, breadth, importance.etc.). This layer of aggregation at the entity level provides a greater signal-to-noise ratio and help analyst focus on what matters.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1546 Event Triggered Execution |
Rule body kusto
id: 9b51b0fb-0419-4450-9ea0-0a48751c4902
name: Vectra Create Incident Based on Priority for Hosts
version: 1.1.1
kind: Scheduled
description: Create an incident when an identity is suspected to be compromised. Vectra is using AI to prioritize an entity based on multiple factors (attack rating, velocity, breadth, importance.etc.). This layer of aggregation at the entity level provides a greater signal-to-noise ratio and help analyst focus on what matters.
status: Available
requiredDataConnectors:
- connectorId: VectraXDR
dataTypes:
- Entities_Data_CL
severity: Medium
queryFrequency: 10m
queryPeriod: 10m
suppressionDuration: PT1H
suppressionEnabled: false
triggerOperator: GreaterThan
triggerThreshold: 0
tactics:
- Persistence
relevantTechniques:
- T1546
query: |
Entities_Data_CL
| where entity_type == "host" and is_prioritized == true
| summarize arg_max(['last_modified_timestamp'], *) by ['name']
entityMappings:
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: name
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: true
lookbackDuration: P7D
matchingMethod: AllEntities
customDetails:
entity_id: id
tags: tags
entity_type: entity_type
attack_profile: attack_profile
ip_address: ip
alertDetailsOverride:
alertDisplayNameFormat: "Vectra AI Incident- {{name}}"
alertDescriptionFormat: An incident has been generated for Vectra AI entity {{name}} that is presenting an urgency score of {{urgency_score}}.
alertDynamicProperties:
- alertProperty: AlertLink
value: url
eventGroupingSettings:
aggregationKind: AlertPerResult
Stages and Predicates
Stage 1: source
Entities_Data_CL
Stage 2: where
| where entity_type == "host" and is_prioritized == true
Stage 3: summarize
| summarize arg_max(['last_modified_timestamp'], *) by ['name']
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
entity_type | eq |
|
is_prioritized | eq |
|