InformationalMicrosoft Sentinel analytics

Vectra AI Detect - Suspicious Behaviors by Category

Create an incident for each new malicious behavior detected by Vectra Detect for a specific Category. By default, it looks through all tactics. This can be modified to create incident only for a subset of tactics.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 7 ATT&CK techniques it maps to.
Log source product: cefama
Log source service: commonsecuritylog

Detection rules

Vectra AI Detect - Suspicious Behaviors by Category

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules