Microsoft Sentinel high experimental kql

Google SecOps - GCTI Threat Intelligence Finding

Creates incidents in Microsoft Sentinel when Google Security Operations raises an active threat intelligence alert (GCTI_FINDING). These alerts are generated by Google's global threat intel corpus and represent high-confidence threats, distinct from customer-authored rule detections.

View Source

Detection Logic

GoogleSecOpsDetectionAlerts
| where detectionType == "GCTI_FINDING"
| where alertState == "ALERTING"

Field Validations

Loading…

Comments (0)

Loading comments...