Microsoft.SecurityInsights alertRules 2022-08-01

Article
02/13/2023

Bicep resource definition

The alertRules resource type is an extension resource, which means you can apply it to another resource.

Use the scope property on this resource to set the scope for this resource. See Set scope on extension resources in Bicep.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/alertRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.SecurityInsights/alertRules@2022-08-01' = {
  name: 'string'
  kind: 'string'
  scope: resourceSymbolicName
  etag: 'string'
  // For remaining properties, see alertRules objects
}

alertRules objects

Set the kind property to specify the type of object.

For Fusion, use:

  kind: 'Fusion'
  properties: {
    alertRuleTemplateName: 'string'
    enabled: bool
  }

For MicrosoftSecurityIncidentCreation, use:

  kind: 'MicrosoftSecurityIncidentCreation'
  properties: {
    alertRuleTemplateName: 'string'
    description: 'string'
    displayName: 'string'
    displayNamesExcludeFilter: [
      'string'
    ]
    displayNamesFilter: [
      'string'
    ]
    enabled: bool
    productFilter: 'string'
    severitiesFilter: [
      'string'
    ]
  }

For Scheduled, use:

  kind: 'Scheduled'
  properties: {
    alertDetailsOverride: {
      alertDescriptionFormat: 'string'
      alertDisplayNameFormat: 'string'
      alertSeverityColumnName: 'string'
      alertTacticsColumnName: 'string'
    }
    alertRuleTemplateName: 'string'
    customDetails: {}
    description: 'string'
    displayName: 'string'
    enabled: bool
    entityMappings: [
      {
        entityType: 'string'
        fieldMappings: [
          {
            columnName: 'string'
            identifier: 'string'
          }
        ]
      }
    ]
    eventGroupingSettings: {
      aggregationKind: 'string'
    }
    incidentConfiguration: {
      createIncident: bool
      groupingConfiguration: {
        enabled: bool
        groupByAlertDetails: [
          'string'
        ]
        groupByCustomDetails: [
          'string'
        ]
        groupByEntities: [
          'string'
        ]
        lookbackDuration: 'string'
        matchingMethod: 'string'
        reopenClosedIncident: bool
      }
    }
    query: 'string'
    queryFrequency: 'string'
    queryPeriod: 'string'
    severity: 'string'
    suppressionDuration: 'string'
    suppressionEnabled: bool
    tactics: [
      'string'
    ]
    techniques: [
      'string'
    ]
    templateVersion: 'string'
    triggerOperator: 'string'
    triggerThreshold: int
  }

Property values

alertRules

Name	Description	Value
name	The resource name	string (required)
kind	Set the object type	Fusion MicrosoftSecurityIncidentCreation Scheduled (required)
scope	Use when creating an extension resource at a scope that is different than the deployment scope.	Target resource For Bicep, set this property to the symbolic name of the resource to apply the extension resource.
etag	Etag of the azure resource	string

FusionAlertRule

Name	Description	Value
kind	The alert rule kind	'Fusion' (required)
properties	Fusion alert rule properties	FusionAlertRuleProperties

FusionAlertRuleProperties

Name	Description	Value
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string (required)
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)

MicrosoftSecurityIncidentCreationAlertRule

Name	Description	Value
kind	The alert rule kind	'MicrosoftSecurityIncidentCreation' (required)
properties	MicrosoftSecurityIncidentCreation rule properties	MicrosoftSecurityIncidentCreationAlertRuleProperties

MicrosoftSecurityIncidentCreationAlertRuleProperties

Name	Description	Value
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string
description	The description of the alert rule.	string
displayName	The display name for alerts created by this alert rule.	string (required)
displayNamesExcludeFilter	the alerts' displayNames on which the cases will not be generated	string[]
displayNamesFilter	the alerts' displayNames on which the cases will be generated	string[]
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)
productFilter	The alerts' productName on which the cases will be generated	'Azure Active Directory Identity Protection' 'Azure Advanced Threat Protection' 'Azure Security Center for IoT' 'Azure Security Center' 'Microsoft Cloud App Security' (required)
severitiesFilter	the alerts' severities on which the cases will be generated	String array containing any of: 'High' 'Informational' 'Low' 'Medium'

ScheduledAlertRule

Name	Description	Value
kind	The alert rule kind	'Scheduled' (required)
properties	Scheduled alert rule properties	ScheduledAlertRuleProperties

ScheduledAlertRuleProperties

Name	Description	Value
alertDetailsOverride	The alert details override settings	AlertDetailsOverride
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string
customDetails	Dictionary of string key-value pairs of columns to be attached to the alert	object
description	The description of the alert rule.	string
displayName	The display name for alerts created by this alert rule.	string (required)
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)
entityMappings	Array of the entity mappings of the alert rule	EntityMapping[]
eventGroupingSettings	The event grouping settings.	EventGroupingSettings
incidentConfiguration	The settings of the incidents that created from alerts triggered by this analytics rule	IncidentConfiguration
query	The query that creates alerts for this rule.	string
queryFrequency	The frequency (in ISO 8601 duration format) for this alert rule to run.	string
queryPeriod	The period (in ISO 8601 duration format) that this alert rule looks at.	string
severity	The severity for alerts created by this alert rule.	'High' 'Informational' 'Low' 'Medium'
suppressionDuration	The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.	string (required)
suppressionEnabled	Determines whether the suppression for this alert rule is enabled or disabled.	bool (required)
tactics	The tactics of the alert rule	String array containing any of: 'Collection' 'CommandAndControl' 'CredentialAccess' 'DefenseEvasion' 'Discovery' 'Execution' 'Exfiltration' 'Impact' 'ImpairProcessControl' 'InhibitResponseFunction' 'InitialAccess' 'LateralMovement' 'Persistence' 'PreAttack' 'PrivilegeEscalation' 'Reconnaissance' 'ResourceDevelopment'
techniques	The techniques of the alert rule	string[]
templateVersion	The version of the alert rule template used to create this rule - in format {a.b.c}, where all are numbers, for example 0 {1.0.2}	string
triggerOperator	The operation against the threshold that triggers alert rule.	'Equal' 'GreaterThan' 'LessThan' 'NotEqual'
triggerThreshold	The threshold triggers this alert rule.	int

AlertDetailsOverride

Name	Description	Value
alertDescriptionFormat	the format containing columns name(s) to override the alert description	string
alertDisplayNameFormat	the format containing columns name(s) to override the alert name	string
alertSeverityColumnName	the column name to take the alert severity from	string
alertTacticsColumnName	the column name to take the alert tactics from	string

EntityMapping

Name	Description	Value
entityType	The V3 type of the mapped entity	'Account' 'AzureResource' 'CloudApplication' 'DNS' 'File' 'FileHash' 'Host' 'IP' 'MailCluster' 'MailMessage' 'Mailbox' 'Malware' 'Process' 'RegistryKey' 'RegistryValue' 'SecurityGroup' 'SubmissionMail' 'URL'
fieldMappings	array of field mappings for the given entity mapping	FieldMapping[]

FieldMapping

Name	Description	Value
columnName	the column name to be mapped to the identifier	string
identifier	the V3 identifier of the entity	string

EventGroupingSettings

Name	Description	Value
aggregationKind	The event grouping aggregation kinds	'AlertPerResult' 'SingleAlert'

IncidentConfiguration

Name	Description	Value
createIncident	Create incidents from alerts triggered by this analytics rule	bool (required)
groupingConfiguration	Set how the alerts that are triggered by this analytics rule, are grouped into incidents	GroupingConfiguration

GroupingConfiguration

Name	Description	Value
enabled	Grouping enabled	bool (required)
groupByAlertDetails	A list of alert details to group by (when matchingMethod is Selected)	String array containing any of: 'DisplayName' 'Severity'
groupByCustomDetails	A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.	string[]
groupByEntities	A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.	String array containing any of: 'Account' 'AzureResource' 'CloudApplication' 'DNS' 'File' 'FileHash' 'Host' 'IP' 'MailCluster' 'MailMessage' 'Mailbox' 'Malware' 'Process' 'RegistryKey' 'RegistryValue' 'SecurityGroup' 'SubmissionMail' 'URL'
lookbackDuration	Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)	string (required)
matchingMethod	Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.	'AllEntities' 'AnyAlert' 'Selected' (required)
reopenClosedIncident	Re-open closed matching incidents	bool (required)

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
Creates a new Microsoft Sentinel Scheduled Analytics Rule	This sample shows how to create a new scheduled analytics rule in Microsoft Sentinel

ARM template resource definition

The alertRules resource type is an extension resource, which means you can apply it to another resource.

Use the scope property on this resource to set the scope for this resource. See Set scope on extension resources in ARM templates.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/alertRules resource, add the following JSON to your template.

{
  "type": "Microsoft.SecurityInsights/alertRules",
  "apiVersion": "2022-08-01",
  "name": "string",
  "kind": "string",
  "scope": "string",
  "etag": "string",
  // For remaining properties, see alertRules objects
}

alertRules objects

Set the kind property to specify the type of object.

For Fusion, use:

  "kind": "Fusion",
  "properties": {
    "alertRuleTemplateName": "string",
    "enabled": "bool"
  }

For MicrosoftSecurityIncidentCreation, use:

  "kind": "MicrosoftSecurityIncidentCreation",
  "properties": {
    "alertRuleTemplateName": "string",
    "description": "string",
    "displayName": "string",
    "displayNamesExcludeFilter": [ "string" ],
    "displayNamesFilter": [ "string" ],
    "enabled": "bool",
    "productFilter": "string",
    "severitiesFilter": [ "string" ]
  }

For Scheduled, use:

  "kind": "Scheduled",
  "properties": {
    "alertDetailsOverride": {
      "alertDescriptionFormat": "string",
      "alertDisplayNameFormat": "string",
      "alertSeverityColumnName": "string",
      "alertTacticsColumnName": "string"
    },
    "alertRuleTemplateName": "string",
    "customDetails": {},
    "description": "string",
    "displayName": "string",
    "enabled": "bool",
    "entityMappings": [
      {
        "entityType": "string",
        "fieldMappings": [
          {
            "columnName": "string",
            "identifier": "string"
          }
        ]
      }
    ],
    "eventGroupingSettings": {
      "aggregationKind": "string"
    },
    "incidentConfiguration": {
      "createIncident": "bool",
      "groupingConfiguration": {
        "enabled": "bool",
        "groupByAlertDetails": [ "string" ],
        "groupByCustomDetails": [ "string" ],
        "groupByEntities": [ "string" ],
        "lookbackDuration": "string",
        "matchingMethod": "string",
        "reopenClosedIncident": "bool"
      }
    },
    "query": "string",
    "queryFrequency": "string",
    "queryPeriod": "string",
    "severity": "string",
    "suppressionDuration": "string",
    "suppressionEnabled": "bool",
    "tactics": [ "string" ],
    "techniques": [ "string" ],
    "templateVersion": "string",
    "triggerOperator": "string",
    "triggerThreshold": "int"
  }

Property values

alertRules

Name	Description	Value
type	The resource type	'Microsoft.SecurityInsights/alertRules'
apiVersion	The resource api version	'2022-08-01'
name	The resource name	string (required)
kind	Set the object type	Fusion MicrosoftSecurityIncidentCreation Scheduled (required)
scope	Use when creating an extension resource at a scope that is different than the deployment scope.	Target resource For JSON, set the value to the full name of the resource to apply the extension resource to.
etag	Etag of the azure resource	string

FusionAlertRule

Name	Description	Value
kind	The alert rule kind	'Fusion' (required)
properties	Fusion alert rule properties	FusionAlertRuleProperties

FusionAlertRuleProperties

Name	Description	Value
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string (required)
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)

MicrosoftSecurityIncidentCreationAlertRule

Name	Description	Value
kind	The alert rule kind	'MicrosoftSecurityIncidentCreation' (required)
properties	MicrosoftSecurityIncidentCreation rule properties	MicrosoftSecurityIncidentCreationAlertRuleProperties

MicrosoftSecurityIncidentCreationAlertRuleProperties

Name	Description	Value
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string
description	The description of the alert rule.	string
displayName	The display name for alerts created by this alert rule.	string (required)
displayNamesExcludeFilter	the alerts' displayNames on which the cases will not be generated	string[]
displayNamesFilter	the alerts' displayNames on which the cases will be generated	string[]
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)
productFilter	The alerts' productName on which the cases will be generated	'Azure Active Directory Identity Protection' 'Azure Advanced Threat Protection' 'Azure Security Center for IoT' 'Azure Security Center' 'Microsoft Cloud App Security' (required)
severitiesFilter	the alerts' severities on which the cases will be generated	String array containing any of: 'High' 'Informational' 'Low' 'Medium'

ScheduledAlertRule

Name	Description	Value
kind	The alert rule kind	'Scheduled' (required)
properties	Scheduled alert rule properties	ScheduledAlertRuleProperties

ScheduledAlertRuleProperties

Name	Description	Value
alertDetailsOverride	The alert details override settings	AlertDetailsOverride
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string
customDetails	Dictionary of string key-value pairs of columns to be attached to the alert	object
description	The description of the alert rule.	string
displayName	The display name for alerts created by this alert rule.	string (required)
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)
entityMappings	Array of the entity mappings of the alert rule	EntityMapping[]
eventGroupingSettings	The event grouping settings.	EventGroupingSettings
incidentConfiguration	The settings of the incidents that created from alerts triggered by this analytics rule	IncidentConfiguration
query	The query that creates alerts for this rule.	string
queryFrequency	The frequency (in ISO 8601 duration format) for this alert rule to run.	string
queryPeriod	The period (in ISO 8601 duration format) that this alert rule looks at.	string
severity	The severity for alerts created by this alert rule.	'High' 'Informational' 'Low' 'Medium'
suppressionDuration	The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.	string (required)
suppressionEnabled	Determines whether the suppression for this alert rule is enabled or disabled.	bool (required)
tactics	The tactics of the alert rule	String array containing any of: 'Collection' 'CommandAndControl' 'CredentialAccess' 'DefenseEvasion' 'Discovery' 'Execution' 'Exfiltration' 'Impact' 'ImpairProcessControl' 'InhibitResponseFunction' 'InitialAccess' 'LateralMovement' 'Persistence' 'PreAttack' 'PrivilegeEscalation' 'Reconnaissance' 'ResourceDevelopment'
techniques	The techniques of the alert rule	string[]
templateVersion	The version of the alert rule template used to create this rule - in format {a.b.c}, where all are numbers, for example 0 {1.0.2}	string
triggerOperator	The operation against the threshold that triggers alert rule.	'Equal' 'GreaterThan' 'LessThan' 'NotEqual'
triggerThreshold	The threshold triggers this alert rule.	int

AlertDetailsOverride

Name	Description	Value
alertDescriptionFormat	the format containing columns name(s) to override the alert description	string
alertDisplayNameFormat	the format containing columns name(s) to override the alert name	string
alertSeverityColumnName	the column name to take the alert severity from	string
alertTacticsColumnName	the column name to take the alert tactics from	string

EntityMapping

Name	Description	Value
entityType	The V3 type of the mapped entity	'Account' 'AzureResource' 'CloudApplication' 'DNS' 'File' 'FileHash' 'Host' 'IP' 'MailCluster' 'MailMessage' 'Mailbox' 'Malware' 'Process' 'RegistryKey' 'RegistryValue' 'SecurityGroup' 'SubmissionMail' 'URL'
fieldMappings	array of field mappings for the given entity mapping	FieldMapping[]

FieldMapping

Name	Description	Value
columnName	the column name to be mapped to the identifier	string
identifier	the V3 identifier of the entity	string

EventGroupingSettings

Name	Description	Value
aggregationKind	The event grouping aggregation kinds	'AlertPerResult' 'SingleAlert'

IncidentConfiguration

Name	Description	Value
createIncident	Create incidents from alerts triggered by this analytics rule	bool (required)
groupingConfiguration	Set how the alerts that are triggered by this analytics rule, are grouped into incidents	GroupingConfiguration

GroupingConfiguration

Name	Description	Value
enabled	Grouping enabled	bool (required)
groupByAlertDetails	A list of alert details to group by (when matchingMethod is Selected)	String array containing any of: 'DisplayName' 'Severity'
groupByCustomDetails	A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.	string[]
groupByEntities	A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.	String array containing any of: 'Account' 'AzureResource' 'CloudApplication' 'DNS' 'File' 'FileHash' 'Host' 'IP' 'MailCluster' 'MailMessage' 'Mailbox' 'Malware' 'Process' 'RegistryKey' 'RegistryValue' 'SecurityGroup' 'SubmissionMail' 'URL'
lookbackDuration	Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)	string (required)
matchingMethod	Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.	'AllEntities' 'AnyAlert' 'Selected' (required)
reopenClosedIncident	Re-open closed matching incidents	bool (required)

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
Creates a new Microsoft Sentinel Scheduled Analytics Rule	This sample shows how to create a new scheduled analytics rule in Microsoft Sentinel

Terraform (AzAPI provider) resource definition

The alertRules resource type is an extension resource, which means you can apply it to another resource.

Use the parent_id property on this resource to set the scope for this resource.

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.SecurityInsights/alertRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.SecurityInsights/alertRules@2022-08-01"
  name = "string"
  parent_id = "string"
  // For remaining properties, see alertRules objects
  body = jsonencode({
    kind = "string"
    etag = "string"
  })
}

alertRules objects

Set the kind property to specify the type of object.

For Fusion, use:

  kind = "Fusion"
  properties = {
    alertRuleTemplateName = "string"
    enabled = bool
  }

For MicrosoftSecurityIncidentCreation, use:

  kind = "MicrosoftSecurityIncidentCreation"
  properties = {
    alertRuleTemplateName = "string"
    description = "string"
    displayName = "string"
    displayNamesExcludeFilter = [
      "string"
    ]
    displayNamesFilter = [
      "string"
    ]
    enabled = bool
    productFilter = "string"
    severitiesFilter = [
      "string"
    ]
  }

For Scheduled, use:

  kind = "Scheduled"
  properties = {
    alertDetailsOverride = {
      alertDescriptionFormat = "string"
      alertDisplayNameFormat = "string"
      alertSeverityColumnName = "string"
      alertTacticsColumnName = "string"
    }
    alertRuleTemplateName = "string"
    customDetails = {}
    description = "string"
    displayName = "string"
    enabled = bool
    entityMappings = [
      {
        entityType = "string"
        fieldMappings = [
          {
            columnName = "string"
            identifier = "string"
          }
        ]
      }
    ]
    eventGroupingSettings = {
      aggregationKind = "string"
    }
    incidentConfiguration = {
      createIncident = bool
      groupingConfiguration = {
        enabled = bool
        groupByAlertDetails = [
          "string"
        ]
        groupByCustomDetails = [
          "string"
        ]
        groupByEntities = [
          "string"
        ]
        lookbackDuration = "string"
        matchingMethod = "string"
        reopenClosedIncident = bool
      }
    }
    query = "string"
    queryFrequency = "string"
    queryPeriod = "string"
    severity = "string"
    suppressionDuration = "string"
    suppressionEnabled = bool
    tactics = [
      "string"
    ]
    techniques = [
      "string"
    ]
    templateVersion = "string"
    triggerOperator = "string"
    triggerThreshold = int
  }

Property values

alertRules

Name	Description	Value
type	The resource type	"Microsoft.SecurityInsights/alertRules@2022-08-01"
name	The resource name	string (required)
parent_id	The ID of the resource to apply this extension resource to.	string (required)
kind	Set the object type	Fusion MicrosoftSecurityIncidentCreation Scheduled (required)
etag	Etag of the azure resource	string

FusionAlertRule

Name	Description	Value
kind	The alert rule kind	"Fusion" (required)
properties	Fusion alert rule properties	FusionAlertRuleProperties

FusionAlertRuleProperties

Name	Description	Value
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string (required)
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)

MicrosoftSecurityIncidentCreationAlertRule

Name	Description	Value
kind	The alert rule kind	"MicrosoftSecurityIncidentCreation" (required)
properties	MicrosoftSecurityIncidentCreation rule properties	MicrosoftSecurityIncidentCreationAlertRuleProperties

MicrosoftSecurityIncidentCreationAlertRuleProperties

Name	Description	Value
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string
description	The description of the alert rule.	string
displayName	The display name for alerts created by this alert rule.	string (required)
displayNamesExcludeFilter	the alerts' displayNames on which the cases will not be generated	string[]
displayNamesFilter	the alerts' displayNames on which the cases will be generated	string[]
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)
productFilter	The alerts' productName on which the cases will be generated	"Azure Active Directory Identity Protection" "Azure Advanced Threat Protection" "Azure Security Center for IoT" "Azure Security Center" "Microsoft Cloud App Security" (required)
severitiesFilter	the alerts' severities on which the cases will be generated	String array containing any of: "High" "Informational" "Low" "Medium"

ScheduledAlertRule

Name	Description	Value
kind	The alert rule kind	"Scheduled" (required)
properties	Scheduled alert rule properties	ScheduledAlertRuleProperties

ScheduledAlertRuleProperties

Name	Description	Value
alertDetailsOverride	The alert details override settings	AlertDetailsOverride
alertRuleTemplateName	The Name of the alert rule template used to create this rule.	string
customDetails	Dictionary of string key-value pairs of columns to be attached to the alert	object
description	The description of the alert rule.	string
displayName	The display name for alerts created by this alert rule.	string (required)
enabled	Determines whether this alert rule is enabled or disabled.	bool (required)
entityMappings	Array of the entity mappings of the alert rule	EntityMapping[]
eventGroupingSettings	The event grouping settings.	EventGroupingSettings
incidentConfiguration	The settings of the incidents that created from alerts triggered by this analytics rule	IncidentConfiguration
query	The query that creates alerts for this rule.	string
queryFrequency	The frequency (in ISO 8601 duration format) for this alert rule to run.	string
queryPeriod	The period (in ISO 8601 duration format) that this alert rule looks at.	string
severity	The severity for alerts created by this alert rule.	"High" "Informational" "Low" "Medium"
suppressionDuration	The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered.	string (required)
suppressionEnabled	Determines whether the suppression for this alert rule is enabled or disabled.	bool (required)
tactics	The tactics of the alert rule	String array containing any of: "Collection" "CommandAndControl" "CredentialAccess" "DefenseEvasion" "Discovery" "Execution" "Exfiltration" "Impact" "ImpairProcessControl" "InhibitResponseFunction" "InitialAccess" "LateralMovement" "Persistence" "PreAttack" "PrivilegeEscalation" "Reconnaissance" "ResourceDevelopment"
techniques	The techniques of the alert rule	string[]
templateVersion	The version of the alert rule template used to create this rule - in format {a.b.c}, where all are numbers, for example 0 {1.0.2}	string
triggerOperator	The operation against the threshold that triggers alert rule.	"Equal" "GreaterThan" "LessThan" "NotEqual"
triggerThreshold	The threshold triggers this alert rule.	int

AlertDetailsOverride

Name	Description	Value
alertDescriptionFormat	the format containing columns name(s) to override the alert description	string
alertDisplayNameFormat	the format containing columns name(s) to override the alert name	string
alertSeverityColumnName	the column name to take the alert severity from	string
alertTacticsColumnName	the column name to take the alert tactics from	string

EntityMapping

Name	Description	Value
entityType	The V3 type of the mapped entity	"Account" "AzureResource" "CloudApplication" "DNS" "File" "FileHash" "Host" "IP" "MailCluster" "MailMessage" "Mailbox" "Malware" "Process" "RegistryKey" "RegistryValue" "SecurityGroup" "SubmissionMail" "URL"
fieldMappings	array of field mappings for the given entity mapping	FieldMapping[]

FieldMapping

Name	Description	Value
columnName	the column name to be mapped to the identifier	string
identifier	the V3 identifier of the entity	string

EventGroupingSettings

Name	Description	Value
aggregationKind	The event grouping aggregation kinds	"AlertPerResult" "SingleAlert"

IncidentConfiguration

Name	Description	Value
createIncident	Create incidents from alerts triggered by this analytics rule	bool (required)
groupingConfiguration	Set how the alerts that are triggered by this analytics rule, are grouped into incidents	GroupingConfiguration

GroupingConfiguration

Name	Description	Value
enabled	Grouping enabled	bool (required)
groupByAlertDetails	A list of alert details to group by (when matchingMethod is Selected)	String array containing any of: "DisplayName" "Severity"
groupByCustomDetails	A list of custom details keys to group by (when matchingMethod is Selected). Only keys defined in the current alert rule may be used.	string[]
groupByEntities	A list of entity types to group by (when matchingMethod is Selected). Only entities defined in the current alert rule may be used.	String array containing any of: "Account" "AzureResource" "CloudApplication" "DNS" "File" "FileHash" "Host" "IP" "MailCluster" "MailMessage" "Mailbox" "Malware" "Process" "RegistryKey" "RegistryValue" "SecurityGroup" "SubmissionMail" "URL"
lookbackDuration	Limit the group to alerts created within the lookback duration (in ISO 8601 duration format)	string (required)
matchingMethod	Grouping matching method. When method is Selected at least one of groupByEntities, groupByAlertDetails, groupByCustomDetails must be provided and not empty.	"AllEntities" "AnyAlert" "Selected" (required)
reopenClosedIncident	Re-open closed matching incidents	bool (required)

Microsoft.SecurityInsights alertRules 2022-08-01

Bicep resource definition

Resource format

alertRules objects

Property values

alertRules

FusionAlertRule

FusionAlertRuleProperties

MicrosoftSecurityIncidentCreationAlertRule

MicrosoftSecurityIncidentCreationAlertRuleProperties

ScheduledAlertRule

ScheduledAlertRuleProperties

AlertDetailsOverride

EntityMapping

FieldMapping

EventGroupingSettings

IncidentConfiguration

GroupingConfiguration

Quickstart templates

ARM template resource definition

Resource format

alertRules objects

Property values

alertRules

FusionAlertRule

FusionAlertRuleProperties

MicrosoftSecurityIncidentCreationAlertRule

MicrosoftSecurityIncidentCreationAlertRuleProperties

ScheduledAlertRule

ScheduledAlertRuleProperties

AlertDetailsOverride

EntityMapping

FieldMapping

EventGroupingSettings

IncidentConfiguration

GroupingConfiguration

Quickstart templates

Terraform (AzAPI provider) resource definition

Resource format

alertRules objects

Property values

alertRules

FusionAlertRule

FusionAlertRuleProperties

MicrosoftSecurityIncidentCreationAlertRule

MicrosoftSecurityIncidentCreationAlertRuleProperties

ScheduledAlertRule

ScheduledAlertRuleProperties

AlertDetailsOverride

EntityMapping

FieldMapping

EventGroupingSettings

IncidentConfiguration

GroupingConfiguration

Feedback

Feedback

Additional resources