NRT GravityZone Incident Alerts

Original query, unchanged.

ASimAlertEventBitdefenderGravityZone(pack=true)
  | extend IncidentType = case(
      AdditionalFields.Module == "new-incident", "EDR Incident",
      AdditionalFields.Module == "new-extended-incident", "XDR Incident",
      AdditionalFields.Module == "ransomware-mitigation", "Ransomware Mitigation",
      AdditionalFields.Module == "network-sandboxing", "Sandbox Analyzer Detection",
      AdditionalFields.Module == "exchange-malware", "Exchange Malware Detection",
      "Incident"   // fallback value if null or unmatched
    ),
    Tactics = AdditionalFields.AttackTypes
  | project EventUid, EventSeverity, EventStartTime, IncidentType, Tactics, EventVendor, EventProduct, DvcId, DvcIpAddr, DvcHostname, DvcAction, DvcFQDN