↳ GitHub sourceAnalytics ruleMedium
Vectra Create Incident Based on Priority for Accounts
Description
Create an incident when an identity is suspected to be compromised. Vectra is using AI to prioritize an entity based on multiple factors (attack rating, velocity, breadth, importance.etc.). This layer of aggregation at the entity level provides a greater signal-to-noise ratio and help analyst focus on what matters.
- Rule type
- Scheduled
- Version
- 1.1.1
- Declared status
- Available
- Query frequency
- 10m
- Query period
- 10m
- Trigger
- GreaterThan 0
Declared MITRE coverage
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Connectors
Data types
KQL query
Original query, unchanged.
Entities_Data_CL
| where entity_type == "account" and is_prioritized == true
| summarize arg_max(['last_modified_timestamp'], *) by ['name']
Declared entities
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
af6f2812-0187-4cc9-822a-952f8b5b6b7e
Additional source files 1
Solutions/Vectra XDR/Analytic Rules/Priority_Account.yamlsource ↗GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC