↳ GitHub sourceAnalytics ruleMedium
Vectra Create Incident Based on Priority for Hosts
Description
Create an incident when an identity is suspected to be compromised. Vectra is using AI to prioritize an entity based on multiple factors (attack rating, velocity, breadth, importance.etc.). This layer of aggregation at the entity level provides a greater signal-to-noise ratio and help analyst focus on what matters.
- Rule type
- Scheduled
- Version
- 1.1.1
- Declared status
- Available
- Query frequency
- 10m
- Query period
- 10m
- Trigger
- GreaterThan 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
Entities_Data_CL
| where entity_type == "host" and is_prioritized == true
| summarize arg_max(['last_modified_timestamp'], *) by ['name']
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
9b51b0fb-0419-4450-9ea0-0a48751c4902
Additional source files 1
Solutions/Vectra XDR/Analytic Rules/Priority_Host.yamlsource ↗GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC