↳ GitHub sourceAnalytics ruleHigh

PAC high severity

Description

'High severity alerts found by Prancer.'
Rule type
Scheduled
Version
1.0.2
Declared status
Available
Query frequency
5h
Query period
5h
Trigger
gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

Data types

KQL query

Original query, unchanged.

union prancer_CL
 | where data_data_resourceID_s contains 'Microsoft.Compute' and severity_s == 'High'
 | project
     Name = name_s,
     Severity = severity_s,
     Description = data_alert_description_s,
     URL = data_alert_url_s,
     Resource = data_data_resourceID_s,
     Config_ID = data_data_configId_s,
     Collection = data_data_applicationName_s,
     MITRE = data_alert_mitreId_s,
     Company = companyName_s,
     Solution = data_alert_solution_s,
     WASC_ID = data_alert_wascid_s,
     CWE_ID = data_alert_cweid_s,
     Evidence = data_alert_evidence_s,
     Request_Header = data_data_requestHeader_s,
     Request_Body = data_data_requestBody_s,
     Response_Header = data_data_responseHeader_s,
     Response_Body = data_data_responseBody_s,
     Other_Data = data_alert_other_s

Declared entities

AzureResourceURL

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
7caa1c03-d20b-42f2-ac95-5232f6e570da
Additional source files 2Solutions/Prancer PenSuiteAI Integration/Analytic Rules/PAC_High_Severity.yamlsource ↗Solutions/Prancer PenSuiteAI Integration/Data/Solutions_PrancerLogIntegration.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.