Support for other rule types

[f-bader]

Summary of the new feature / enhancement

Add support for
[ ] Fusion
[ ] NRT
[ ] ML
[ ] Threat Intelligence
[ ] Microsoft Security

Proposed technical implementation details (optional)

Based on YAML or ARM template rule detection

[Manbearpiet]

Can we perhaps agree on some sort of documented format on how to store these as YAML?
Will everything be a top level property? Will all properties always be available, what's the minimum and what is an extensive example?

• Fusion example?
• NRT example
• ML example?
• Threat Intelligence example?
• Microsoft Security example?

[f-bader]

Definitely. I will create some extensive YAML files that we can use for validation purposes

[f-bader]

The first two examples

• Scheduled example
• NRT example

[f-bader]

Basically we should implement a 1:1 version of the ARM template converted to YAML with the following changes:

• Reorder the YAML for better readability
• Rename the following parameters to match Sentinel YAML format
  • displayName = name
  • alertRuleTemplateName = id
  • templateVersion = version
  • techniques = relevantTechniques
• Change triggerOperator to match YAML
  • Equals = eq
  • GreaterThan = gt
  • GreaterThanOrEqual = ge
  • LessThan = lt
  • LessThanOrEqual = le

Microsoft.SecurityInsights alertRules

Scheduled

alertDetailsOverride:
  alertDescriptionFormat: string
  alertDisplayNameFormat: string
  alertDynamicProperties:
  - alertProperty: string
    value: string
  alertSeverityColumnName: string
  alertTacticsColumnName: string
id: string
customDetails: {}
description: string
name: string
enabled: bool
entityMappings:
- entityType: string
  fieldMappings:
  - columnName: string
    identifier: string
eventGroupingSettings:
  aggregationKind: string
incidentConfiguration:
  createIncident: bool
  groupingConfiguration:
    enabled: bool
    groupByAlertDetails:
    - string
    groupByCustomDetails:
    - string
    groupByEntities:
    - string
    lookbackDuration: string
    matchingMethod: string
    reopenClosedIncident: bool
query: string
queryFrequency: string
queryPeriod: string
sentinelEntitiesMappings:
- columnName: string
severity: string
suppressionDuration: string
suppressionEnabled: bool
tactics:
- string
relevantTechniques:
- string
version: string
triggerOperator: string
triggerThreshold: int