Microsoft Sentinel high experimental kql
Google SecOps - GCTI Threat Intelligence Finding
Creates incidents in Microsoft Sentinel when Google Security Operations raises an active threat intelligence alert (GCTI_FINDING). These alerts are generated by Google's global threat intel corpus and represent high-confidence threats, distinct from customer-authored rule detections.
Detection Logic
GoogleSecOpsDetectionAlerts
| where detectionType == "GCTI_FINDING"
| where alertState == "ALERTING" Field Validations
Loading…
Comments (0)
Loading comments...