Microsoft Sentinel high experimental kql

Vectra Create Incident Based on Tag for Hosts

Create an incident when the host entity presents a specific tag. If the tag is present, an incident should be created and marked with highest priority.

View Source

Detection Logic

Entities_Data_CL
| where entity_type == "host"
| extend Tags = todynamic(tags)
| where set_has_element(Tags, "MDR - Customer Escalation")
| summarize arg_max(['last_modified_timestamp'], *) by ['name']

Field Validations

Loading…

Comments (0)

Loading comments...