↳ GitHub sourceAnalytics ruleHigh

Darktrace Model Alert

Description

This query searches for Darktrace model alerts and creates a Microsoft Sentinel alert from each matching event. Edit this analytic rule if you would like it to create Microsoft Sentinel incidents.

Rule type: NRT
Version: 1.1.0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

DarktraceActiveAISecurityPlatform

Data types

DarktraceModelAlerts_CL

KQL query

Original query, unchanged.

DarktraceModelAlerts_CL
| where TimeGenerated >= ago(5m)
| extend SentinelSeverity = case(
compliance == true, "Informational",
category == "Informational", "Low",
category == "Suspicious", "Medium",
category == "Critical", "High",
"Informational")
| extend ProviderName = "Darktrace"
| mv-apply item = mitreTechniques on (
    extend techniqueId = tostring(item.techniqueId)
    | summarize techniqueIdArray = make_list(techniqueId, 5)
)

Declared entities

AccountIPHost

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Darktrace/Analytic Rules/DarktraceModelAlert.yaml ↗
Commit: 9800e51 ↗
Source identifier: 9392a06f-63a4-4a5d-8ca3-647064b13c28

Additional source files 2

Solutions/Darktrace/Analytic Rules/DarktraceModelAlert.yamlsource ↗Solutions/Darktrace/Data/Solution_DarktraceEnterpriseImmuneSystem.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.