Darktrace Model Breach (Legacy)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This rule creates Microsoft Sentinel Alerts based on Darktrace Model Breaches, fetched every 5 minutes.

Attribute	Value
Type	Analytic Rule
Solution	Darktrace
ID	a3c7b8ed-56a9-47b7-98e5-2555c16e17c9
Severity	Medium
Kind	NRT
Tactics	InitialAccess, Execution, LateralMovement, CommandAndControl
Techniques	T1190, T1059, T1021, T1071
Required Connectors	DarktraceRESTConnector
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
darktrace_model_alerts_CL 🔶		✓	✓	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Darktrace