Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature Request] Support new ThreatIntelligence rule kind #190

Open
pemontto opened this issue Oct 1, 2021 · 0 comments
Open

[Feature Request] Support new ThreatIntelligence rule kind #190

pemontto opened this issue Oct 1, 2021 · 0 comments

Comments

@pemontto
Copy link
Contributor

pemontto commented Oct 1, 2021

Summary of the new feature/enhancement

Azure Sentinel templates include a new rule kind ThreatIntelligence. It would be useful if this could be deployed by AzSentinel.

It looks like this:

{
  "ThreatIntelligence": [
    {
      "alertRuleTemplateName": "xyz",
      "severity": "Medium",
      "tactics": [
        "Persistence",
        "LateralMovement"
      ],
      "displayName": "(Preview) Microsoft Threat Intelligence Analytics",
      "enabled": true,
      "description": "This rule generates an alert when a Microsoft Threat Intelligence Indicator gets matched with your event logs. The alerts are very high fidelity.\n\nNote : It is advised to turn off any custom alert rules which match the threat intelligence indicators with the same event logs matched by this analytics to prevent duplicate alerts.",
      "name": "xyz",
      "kind": "ThreatIntelligence"
    }
  ]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant