↳ GitHub sourceAnalytics ruleMedium

Vectra AI Detect - New Campaign Detected

Description

'Identifies when a new Campaign has been detected. This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'

Rule type: Scheduled
Version: 1.2.3
Declared status: Available
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

CefAma

Data types

CommonSecurityLog

KQL query

Original query, unchanged.

CommonSecurityLog
| where DeviceVendor == "Vectra Networks"
| where DeviceProduct == "X Series"
| where DeviceEventClassID contains "campaign"
| where DeviceAction == "START"
| extend reason = coalesce(
                          column_ifexists("Reason", ""), 
                          extract("reason=(.+?)($|;)", 1, AdditionalExtensions),
                          ""
                      )
| project-rename vectra_URL = DeviceCustomString4
| sort by TimeGenerated

Declared entities

DNS

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yaml ↗
Commit: 9800e51 ↗
Source identifier: a34d0338-eda0-42b5-8b93-32aae0d7a501

Additional source files 2

Solutions/Vectra AI Detect/Analytic Rules/VectraDetect-NewCampaign.yamlsource ↗Solutions/Vectra AI Detect/Data/Solution_Vectra AI Detect.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.