AZSentinel
AZSentinel copied to clipboard
[Feature Request] Support new ThreatIntelligence rule kind
Summary of the new feature/enhancement
Azure Sentinel templates include a new rule kind ThreatIntelligence
. It would be useful if this could be deployed by AzSentinel.
It looks like this:
{
"ThreatIntelligence": [
{
"alertRuleTemplateName": "xyz",
"severity": "Medium",
"tactics": [
"Persistence",
"LateralMovement"
],
"displayName": "(Preview) Microsoft Threat Intelligence Analytics",
"enabled": true,
"description": "This rule generates an alert when a Microsoft Threat Intelligence Indicator gets matched with your event logs. The alerts are very high fidelity.\n\nNote : It is advised to turn off any custom alert rules which match the threat intelligence indicators with the same event logs matched by this analytics to prevent duplicate alerts.",
"name": "xyz",
"kind": "ThreatIntelligence"
}
]
}