↳ GitHub sourceAnalytics ruleMedium

Field Effect MDR Alert: ARO Alert

View on GitHub ↗Original file ↗

Description

Creates an incident for each Field Effect MDR ARO alert ingested into the workspace.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

FieldEffectCCF

Data types

FieldEffectAROAlerts_CL

KQL query

Original query, unchanged.

FieldEffectAROAlerts_CL
| where TimeGenerated >= ago(5m)
| project
    TimeGenerated,
    ARO = ID,
    TITLE = Title,
    DETAILS = DetailsMarkdown,
    URL = PortalUrl,
    SEVERITY = Severity,
    Hostname,
    IPAddress,
    LastUser,
    PRODUCT_NAME = "Field Effect MDR"

Declared entities

IPAccountHost

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/FieldEffectMDR/Analytic Rules/AROAlert.yaml ↗
Commit: 9800e51 ↗
Source identifier: 6d2d6b3f-7d7b-4d4a-9b2b-9f7f3b8c2a11

Additional source files 2

Solutions/FieldEffectMDR/Analytic Rules/AROAlert.yamlsource ↗Solutions/FieldEffectMDR/Data/Solution_FieldEffect.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.