Elastic medium stable kql
Microsoft Sentinel External Alerts
Generates a detection alert for each Microsoft Sentinel alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Microsoft Sentinel alerts in the app.
Detection Logic
event.kind: alert and data_stream.dataset: microsoft_sentinel.alertField Validations
Loading…
Comments (0)
Loading comments...