↳ GitHub sourceAnalytics ruleHigh

BitSight - new alert found

View on GitHub ↗Original file ↗

Description

'Rule helps to detect a new alerts generated in BitSight.'

Rule type: Scheduled
Version: 1.0.1
Declared status: Available
Query frequency: 1d
Query period: 24h
Trigger: GreaterThan 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

BitSight

Data types

BitSightAlerts

KQL query

Original query, unchanged.

let timeframe = 24h;
BitSightAlerts
| where ingestion_time() > ago(timeframe)
| extend Severity = case( Severity contains "INCREASE", "Low",
                          Severity contains "WARN" or Severity contains "DECREASE", "Medium",
                          Severity contains "CRITICAL", "High",
                          "Informational")
| extend CompanyURL = strcat("https://service.bitsighttech.com/app/spm",CompanyURL)
| project CompanyName, Severity, Trigger, CompanyURL, AlertDate, GUID

Declared entities

URL

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/BitSight/Analytic Rules/BitSightNewAlertFound.yaml ↗
Commit: 9800e51 ↗
Source identifier: a1275c5e-0ff4-4d15-a7b7-96018cd979f5

Additional source files 2

Solutions/BitSight/Analytic Rules/BitSightNewAlertFound.yamlsource ↗Solutions/BitSight/Data/Solution_BitSight.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.