↳ GitHub sourceAnalytics ruleHigh

Darktrace Incident Event

View on GitHub ↗Original file ↗

Description

This query searches for Darktrace incident events and creates a Microsoft Sentinel incident for each matching result.

Rule type: NRT
Version: 1.1.0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

DarktraceActiveAISecurityPlatform

Data types

DarktraceIncidents_CL

KQL query

Original query, unchanged.

DarktraceIncidents_CL
| where TimeGenerated >= ago(5m)
| extend SentinelSeverity = case(groupCategory == "suspicious", "Medium",
groupCategory == "critical", "High", "Informational")
| extend ProviderName = "Darktrace"

Declared entities

AccountIPHost

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Darktrace/Analytic Rules/DarktraceIncidentEvent.yaml ↗
Commit: 9800e51 ↗
Source identifier: 05de0eaf-01bc-4615-99fc-2ec769864b34

Additional source files 2

Solutions/Darktrace/Analytic Rules/DarktraceIncidentEvent.yamlsource ↗Solutions/Darktrace/Data/Solution_DarktraceEnterpriseImmuneSystem.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.