Vectra RUX - Create Incident for Escalated Account Detection or Unresolved Priority Account

id: 231904f5-b670-4223-9bec-2e9aeca9cf5a
name: Vectra RUX - Create Incident for Escalated Account Detection or Unresolved Priority Account
version: 1.0.0
kind: Scheduled
description: |
  This query creates a Microsoft Sentinel incident when a detection on an account entity has been escalated in Vectra
  (investigation_status = escalated). Escalation indicates that a human analyst or MDR service
  has reviewed the detection and determined it requires immediate customer attention or notification.
  One incident is created per detection - grouping is based on alert display name so that
  repeated rule evaluations against the same detection do not create duplicate incidents.

  This query creates a Microsoft Sentinel incident when Vectra AI identifies an account entity with one or more detections
  marked as unresolved and prioritized (unresolved_priority = true). Vectra's AI engine assigns
  priority based on attack rating, velocity, breadth, and identity privilege level. This rule surfaces
  account-based threats that require analyst attention.

  Incidents are grouped per account entity and remain open while the threat persists. Once all associated
  detections are resolved in Vectra, the incident can be closed in Microsoft Sentinel.
status: Available
requiredDataConnectors:
  - connectorId: VectraRUXConnector
    dataTypes:
      - VectraDetectionsCombined
severity: High
queryFrequency: 10m
queryPeriod: 10m
suppressionDuration: PT1H
suppressionEnabled: false
triggerOperator: GreaterThan
triggerThreshold: 0
tactics:
  - Discovery
  - LateralMovement
  - CredentialAccess
  - Exfiltration
  - CommandAndControl
  - Persistence
relevantTechniques:
  - T1078
  - T1110
  - T1003
  - T1041
  - T1071
query: |
  VectraDetectionsCombined
  | where ["Entity Type"] == "account"
  | summarize arg_max(TimeGenerated, *) by ["Detection ID"]
  | where ["Investigation Status"] == "escalated" or ["Unresolved Priority"] == true
  | extend
      detection_name     = ["D Type Vname"],
      detection_category = ["Detection Category"],
      entity_url         = replace_string(replace_string(URL, "api/v3.4/", ""), "api/v3.5/", ""),
      mitre_techniques   = tostring(Mitre),
      detection_tags     = tostring(Tags),
      assigned_to        = ["Assigned To"],
      entity_name = ["Entity Name"],
      entity_uid = ["Entity UID"],
      entity_id = ["Entity ID"],
      detection_id = ["Detection ID"],
      external_reference = ["External Reference ID"],
      investigation_status = ["Investigation Status"],
      entity_type = ["Entity Type"]
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: entity_name
      - identifier: UPNSuffix
        columnName: entity_uid
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: Selected
    groupByEntities:
      - Account
    groupByAlertDetails:
      - DisplayName
customDetails:
  detection_name: detection_name
  assigned_to: assigned_to
  entity_uid: entity_uid
  entity_url: entity_url
  entity_id: entity_id
  detection_id: detection_id
  external_reference: external_reference
  investigation_status: investigation_status
  category: detection_category
  tags: detection_tags
  entity_type: entity_type
  mitre_techniques: mitre_techniques
alertDetailsOverride:
  alertDisplayNameFormat: "Vectra AI - {{detection_name}} on {{entity_name}}"
  alertDescriptionFormat: >
    Vectra AI has escalated detection {{detection_name}} ({{detection_category}}) on account or identified
    account {{entity_name}} as a priority threat. See custom details for full context.
  alertDynamicProperties:
    - alertProperty: AlertLink
      value: entity_url
    - alertProperty: Techniques
      value: mitre_techniques
eventGroupingSettings:
  aggregationKind: AlertPerResult