Telemetry Evidence
These values show how indexed rules identify Vectra telemetry.Kusto
- Queried source table
CommonSecurityLog (7 rules) - Queried source table
Entities_Data_CL (4 rules) - Queried source table
VectraDetections (2 rules) - Queried source table
VectraDetectionsCombined (2 rules) - Query discriminator
DeviceVendor = Vectra Networks (7 rules) - Source collection
Vectra AI Detect (7 rules)
Detection Rules
Kusto #
- Vectra Create Detection Alert for Accounts source medium: This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monitored by the Vectra Platform
T1546 - Vectra Create Detection Alert for Hosts source medium: This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. The intent is to create entries in the SecurityAlert table for every new detection attached to an entity monitored by the Vectra Platform
T1546 - Vectra Create Incident Based on Priority for Accounts source medium: Create an incident when an identity is suspected to be compromised. Vectra is using AI to prioritize an entity based on multiple factors (attack rating, velocity, breadth, importance.etc.). This layer of aggregation at the entity level provides a greater signal-to-noise ratio and help analyst focus on what matters.
T1546 - Vectra Create Incident Based on Priority for Hosts source medium: Create an incident when an identity is suspected to be compromised. Vectra is using AI to prioritize an entity based on multiple factors (attack rating, velocity, breadth, importance.etc.). This layer of aggregation at the entity level provides a greater signal-to-noise ratio and help analyst focus on what matters.
T1546 - Vectra Create Incident Based on Tag for Accounts source high: Create an incident when the account entity presents a specific tag. If the tag is present, an incident should be created and marked with highest priority.
T1546 - Vectra Create Incident Based on Tag for Hosts source high: Create an incident when the host entity presents a specific tag. If the tag is present, an incident should be created and marked with highest priority.
T1546 - Vectra RUX - Create Incident for Escalated Account Detection or Unresolved Priority Account source high: This query creates a Microsoft Sentinel incident when a detection on an account entity has been escalated in Vectra (investigation_status = escalated). Escalation indicates that a human analyst or MDR service has reviewed the detection and determined it requires immediate customer attention or notification. One incident is created per detection - grouping is based on alert display name so that repeated rule evaluations against the same detection do not create duplicate incidents. This query creates a Microsoft Sentinel incident when Vectra AI identifies an account entity with one or more detections marked as unresolved and prioritized (unresolved_priority = true). Vectra's AI engine assigns priority based on attack rating, velocity, breadth, and identity privilege level. This rule surfaces account-based threats that require analyst attention. Incidents are grouped per account entity and remain open while the threat persists. Once all associated detections are resolved in Vectra, the incident can be closed in Microsoft Sentinel.
T1003, T1041, T1071, T1078, T1110 - Vectra RUX - Create Incident for Escalated Host Detection or Unresolved Priority Host source high: This query creates a Microsoft Sentinel incident when a detection on a host entity has been escalated in Vectra (investigation_status = escalated). Escalation indicates that a human analyst or MDR service has reviewed the detection and determined it requires immediate host attention or notification. One incident is created per detection - grouping is based on alert display name so that repeated rule evaluations against the same detection do not create duplicate incidents. This query creates a Microsoft Sentinel incident when Vectra AI identifies a host entity with one or more detections marked as unresolved and prioritized (unresolved_priority = true). Vectra's AI engine assigns priority based on attack rating, velocity, breadth, and host privilege level. This rule surfaces host-based threats that require analyst attention. Incidents are grouped per host entity and remain open while the threat persists. Once all associated detections are resolved in Vectra, the incident can be closed in Microsoft Sentinel.
T1003, T1021, T1041, T1046, T1071
Product-Filtered Rules
These rules use generic transport telemetry with a product-specific filter for Vectra.Kusto #
- Vectra Account's Behaviors source informational: 'This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. This rule is focused on account's detections.'
T1003, T1021, T1041, T1071, T1087, T1119 - Vectra AI Detect - Detections with High Severity source high: 'Create an incident for high severity malicious behavior detected by Vectra AI (Threat score superior to 7.0). The Severity is a mapping with the Threat score assigned to a detection. It ranges between 0 and 10. The severity_threshold variable can be adjusted as desired.'
T1003, T1021, T1041, T1071, T1087, T1119 - Vectra AI Detect - New Campaign Detected source medium: 'Identifies when a new Campaign has been detected. This occurs when multiple Detections accross different Hosts are suspected to be part of the same Attack Campaign.'
T1021, T1071 - Vectra AI Detect - Suspected Compromised Account source informational: 'Create an incident when an Account is suspected to be compromised. The higher the severity level is, the more immediate attention it requires as Vectra AI engine is more confident that this is a real threat. Level of severity are: Low, Medium, High, Critical). Recommended configuration is to trigger an alert for at least High and Critical.'
T1003, T1021, T1041, T1071, T1087, T1119 - Vectra AI Detect - Suspected Compromised Host source informational: 'Create an incident when a Host is suspected to be compromised. The higher the severity level is, the more immediate attention it requires as Vectra AI engine is more confident that this is a real threat. Level of severity are: Low, Medium, High, Critical). Recommended configuration is to trigger an alert for at least High and Critical.'
T1003, T1021, T1041, T1071, T1087, T1119 - Vectra AI Detect - Suspicious Behaviors by Category source informational: 'Create an incident for each new malicious behavior detected by Vectra Detect for a specific Category. By default, it looks through all tactics. This can be modified to create incident only for a subset of tactics.'
T1003, T1021, T1041, T1071, T1087, T1119 - Vectra Host's Behaviors source informational: 'This analytic rule is looking for new attacker behaviors observed by the Vectra Platform. This rule is focused on host's detections.'
T1003, T1021, T1041, T1071, T1087, T1119
Compatible Rules
These rules declare Vectra connector or schema compatibility without a product-specific query filter.Kusto #
- Anomaly found in Network Session Traffic (ASIM Network Session schema) source medium: The rule identifies anomalous pattern in network session traffic based on previously seen data, different Device Action, Network Protocol, Network Direction or overall volume. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema. This rule leverages log summaries generated by a Summary Rule or Summarized Playbook. If no such summaries are available, the rule falls back to direct analysis using ASIM function.
T1030, T1046, T1071, T1095, T1210 - Detect port misuse by anomaly based detection (ASIM Network Session schema) source medium: This rule detects anomalous pattern in port usage. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema. To tune the rule to your environment configure it using the 'NetworkSession_Monitor_Configuration' watchlist. This rule leverages log summaries generated by a Summary Rule or Summarized Playbook. If no such summaries are available, the rule falls back to direct analysis using ASIM function.
T1059, T1095, T1190, T1203 - Detect port misuse by static threshold (ASIM Network Session schema) source medium: This detection rule detects port usage above the configured threshold. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema. To tune the rule to your environment configure it using the 'NetworkSession_Monitor_Configuration' watchlist. This rule leverages log summaries generated by a Summary Rule or Summarized Playbook. If no such summaries are available, the rule falls back to direct analysis using ASIM function.
T1059, T1095, T1190, T1203 - Excessive number of failed connections from a single source (ASIM Network Session schema) source medium: This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive is the rule and less incidents will be generated. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schema
T1499 - GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema) source medium: This rule identifies a match Network Sessions for which the source or destination IP address is a known GreyNoise IoC. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schema
T1071 - Network Port Sweep from External Network (ASIM Network Session schema) source high: This detection rule detects scenarios when a particular port is being scanned by multiple external sources. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema.
T1046, T1590 - Port scan detected (ASIM Network Session schema) source medium: This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a port scanner is trying to identify open ports in order to penetrate a system. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schema
T1046 - Possible Phishing with CSL and Network Sessions source medium: This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. If your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored.
T1102, T1566 - Potential beaconing activity (ASIM Network Session schema) source low: This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. Such potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this Blog. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schema'
T1071, T1571 - TI Map IP entity to Network Session Events (ASIM Network Session schema) source medium: This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schema
T1071 - TI map IP entity to Network Session Events (ASIM Network Session schema) source medium: This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schema
T1071
Package-Only Rules
These rules appear in the Vectra Sentinel solution, but their queries do not identify Vectra telemetry. They do not count toward Rules.Kusto #
- Defender Alert Evidence source high: This analytic rule is looking for new alert evidence from Microsoft Defender for Endpoint. The intent is to create entries in the SecurityAlert table for every new alert evidence attached to an entity of type Device or User monitored by Defender for Endpoint.
T1546