Detection rules › Kusto
ZeroFox Alerts - High Severity Alerts
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
'Detects high severity alerts from ZeroFox'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Resource Development | T1583 Acquire Infrastructure, T1586 Compromise Accounts |
| Initial Access | T1566 Phishing |
Rule body kusto
id: deb45e6d-892f-40bf-9118-e2a6f26b788d
name: ZeroFox Alerts - High Severity Alerts
description: |
'Detects high severity alerts from ZeroFox'
severity: High
status: Available
requiredDataConnectors:
- connectorId: ZeroFox_Alert_Polling
dataTypes:
- ZeroFoxAlertPoller_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
- ResourceDevelopment
- InitialAccess
relevantTechniques:
- T1583
- T1586
- T1566
query: |
ZeroFoxAlertPoller_CL
| where Severity in (5)
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: entity_name_s
eventGroupingSettings:
aggregationKind: AlertPerResult
kind: Scheduled
version: 1.0.0
Stages and Predicates
Stage 1: source
ZeroFoxAlertPoller_CL
Stage 2: where
| where Severity in (5)
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Severity | in |
|