Microsoft Sentinel low experimental kql

Cyble Vision Alerts Flash Report

'Detects new threat intelligence flash reports from CybleVision. Extracts company-level context and report identifiers for triage.'

View Source

Detection Logic

Alerts_flash_report
| where Service == "flash_report"
| extend MappedSeverity = Severity

Field Validations

Loading…

Comments (0)

Loading comments...