Get in touch
← Sentinel Explorer
↳ GitHub sourceAnalytics ruleMedium

Contrast ADR - Security Incident Alert

View on GitHub ↗Original file ↗

Description

'Monitors Contrast ADR security incidents across all applications and environments. This rule creates alerts for all security incidents detected by Contrast Security ADR, providing comprehensive visibility into application security events requiring investigation.'
Rule type
Scheduled
Version
1.0.1
Declared status
Available
Query frequency
5m
Query period
5m
Trigger
gt 0

Declared MITRE coverage

InitialAccessDefenseEvasionDiscoveryCommandAndControlT1190T1055T1018T1008

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

ContrastADRCCF

Data types

ContrastADRIncidents_CL

KQL query

Original query, unchanged.

ContrastADRIncidents_CL

Declared entities

SecurityGroup

Related content

Links established from declared identifiers and solution manifests.

Solutions1
Connectors1

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
7ce5956f-48f2-42f5-8e2e-c254e7643c11
Additional source files 2Solutions/ContrastADR/Analytic Rules/Contrast_Security_ADR_incident.yamlsource ↗Solutions/ContrastADR/Data/Solution_ContrastADR.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.