Microsoft Sentinel low experimental kql

Cyble Vision Alerts Assets

'Scheduled rule that creates incidents for asset alerts using saved parser Alerts_assets. Mandatory custom details: MappedSeverity, Status, AlertID, Service.'

View Source

Detection Logic

Alerts_assets
| where Service == "assets"
| extend MappedSeverity = Severity

Field Validations

Loading…

Comments (0)

Loading comments...