← Sentinel Explorer

↳ GitHub sourceAnalytics ruleHigh

Theom Critical Risks

View on GitHub ↗Original file ↗

Description

"Creates Microsoft Sentinel incidents for critical risk Theom alerts."

Rule type: Scheduled
Version: 1.0.3
Declared status: Available
Query frequency: 5m
Query period: 5m
Trigger: gt 0

Declared MITRE coverage

Collection CommandAndControl CredentialAccess DefenseEvasion Discovery Exfiltration Impact Reconnaissance T1592 T1589 T1070 T1552 T1619 T1119 T1560 T1530 T1213 T1001 T1041 T1537 T1485 T1486 T1565

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

Data types

KQL query

Original query, unchanged.

TheomAlerts_CL
 | where priority_s == "P1"

Declared entities

CloudApplicationURL

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Theom/Analytic Rules/TheomRisksCritical.yaml ↗
Commit: 9800e51 ↗
Source identifier: bb9051ef-0e72-4758-a143-80c25ee452f0

Additional source files 2

Solutions/Theom/Analytic Rules/TheomRisksCritical.yamlsource ↗Solutions/Theom/Data/Solution_Theom.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.