Skip to content

Commit 452af38

Browse files
yelevinyelevin
committed
Supported entity properties
1 parent 90ad39e commit 452af38

File tree

2 files changed

+55
-3
lines changed

2 files changed

+55
-3
lines changed

‎articles/sentinel/automate-incident-handling-with-automation-rules.md

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ Even without being onboarded to the unified portal, you might anyway decide to u
9191
9292
### Conditions
9393

94-
Complex sets of conditions can be defined to govern when actions (see below) should run. These conditions include the event that triggers the rule (incident created or updated, or alert created), the states or values of the incident's properties and [entity properties](entities-reference.md) (for incident trigger only), and also the analytics rule or rules that generated the incident or alert.
94+
Complex sets of conditions can be defined to govern when actions (see below) should run. These conditions include the event that triggers the rule (incident created or updated, or alert created), the states or values of the incident's properties and [entity properties](#supported-entity-properties) (for incident trigger only), and also the analytics rule or rules that generated the incident or alert.
9595

9696
When an automation rule is triggered, it checks the triggering incident or alert against the conditions defined in the rule. For incidents, the property-based conditions are evaluated according to **the current state** of the property at the moment the evaluation occurs, or according to **changes in the state** of the property (see below for details). Since a single incident creation or update event could trigger several automation rules, the **order** in which they run (see below) makes a difference in determining the outcome of the conditions' evaluation. The **actions** defined in the rule are executed only if all the conditions are satisfied.
9797

@@ -168,6 +168,58 @@ In this example, in *Incident 1*:
168168

169169
In *Incident 2*, the outcome is the same, regardless of which type of condition is defined.
170170

171+
#### Supported entity properties
172+
173+
The following entities and entity properties can be used as conditions for automation rules:
174+
175+
| Name | Type | Description |
176+
|-------------------------------|--------|-------------------------------------------------------------|
177+
| AccountAadTenantId | string | The account Microsoft Entra ID tenant ID |
178+
| AccountAadUserId | string | The account Microsoft Entra ID user ID |
179+
| AccountName | string | The account name |
180+
| AccountNTDomain | string | The account NetBIOS domain name |
181+
| AccountPUID | string | The account Microsoft Entra ID Passport User ID |
182+
| AccountSid | string | The account security identifier |
183+
| AccountObjectGuid | string | The account object unique identifier |
184+
| AccountUPNSuffix | string | The account user principal name suffix |
185+
| AzureResourceResourceId | string | The Azure resource ID |
186+
| AzureResourceSubscriptionId | string | The Azure resource subscription ID |
187+
| CloudApplicationAppId | string | The cloud application identifier |
188+
| CloudApplicationAppName | string | The cloud application name |
189+
| DNSDomainName | string | The dns record domain name |
190+
| FileDirectory | string | The file directory full path |
191+
| FileName | string | The file name without path |
192+
| FileHashValue | string | The file hash value |
193+
| HostAzureID | string | The host Azure resource ID |
194+
| HostName | string | The host name without domain |
195+
| HostNetBiosName | string | The host NetBIOS name |
196+
| HostNTDomain | string | The host NT domain |
197+
| HostOSVersion | string | The host operating system |
198+
| IoTDeviceId | string | The IoT device ID |
199+
| IoTDeviceName | string | The IoT device name |
200+
| IoTDeviceType | string | The IoT device type |
201+
| IoTDeviceVendor | string | The IoT device vendor |
202+
| IoTDeviceModel | string | The IoT device model |
203+
| IoTDeviceOperatingSystem | string | The IoT device operating system |
204+
| IPAddress | string | The IP address |
205+
| MailboxDisplayName | string | The mailbox display name |
206+
| MailboxPrimaryAddress | string | The mailbox primary address |
207+
| MailboxUPN | string | The mailbox user principal name |
208+
| MailMessageDeliveryAction | string | The mail message delivery action |
209+
| MailMessageDeliveryLocation | string | The mail message delivery location |
210+
| MailMessageRecipient | string | The mail message recipient |
211+
| MailMessageSenderIP | string | The mail message sender IP address |
212+
| MailMessageSubject | string | The mail message subject |
213+
| MailMessageP1Sender | string | The mail message P1 sender |
214+
| MailMessageP2Sender | string | The mail message P2 sender |
215+
| MalwareCategory | string | The malware category |
216+
| MalwareName | string | The malware name |
217+
| ProcessCommandLine | string | The process execution command line |
218+
| ProcessId | string | The process ID |
219+
| RegistryKey | string | The registry key path |
220+
| RegistryValueData | string | The registry key value in string formatted representation |
221+
| Url | string | The url |
222+
171223
#### Alert create trigger
172224

173225
Currently the only condition that can be configured for the alert creation trigger is the set of analytics rules for which the automation rule is run.

‎articles/sentinel/create-manage-use-automation-rules.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ Use the options in the **Conditions** area to define conditions for your automat
151151

152152
| Property | Operator set |
153153
| -------- | -------- |
154-
| - **Title**<br>- **Description**<br>- All listed **entity properties** | - Equals/Does not equal<br>- Contains/Does not contain<br>- Starts with/Does not start with<br>- Ends with/Does not end with |
154+
| - **Title**<br>- **Description**<br>- All listed **entity properties**<br>&nbsp;&nbsp;(see [supported entity properties](automate-incident-handling-with-automation-rules.md#supported-entity-properties)) | - Equals/Does not equal<br>- Contains/Does not contain<br>- Starts with/Does not start with<br>- Ends with/Does not end with |
155155
| - **Tag** (See [individual vs. collection](automate-incident-handling-with-automation-rules.md#tag-property-individual-vs-collection)) | **Any individual tag:**<br>- Equals/Does not equal<br>- Contains/Does not contain<br>- Starts with/Does not start with<br>- Ends with/Does not end with<br><br>**Collection of all tags:**<br>- Contains/Does not contain |
156156
| - **Severity**<br>- **Status**<br>- **Custom details key** | - Equals/Does not equal |
157157
| - **Tactics**<br>- **Alert product names**<br>- **Custom details value**<br>- **Analytic rule name** | - Contains/Does not contain |
@@ -160,7 +160,7 @@ Use the options in the **Conditions** area to define conditions for your automat
160160

161161
| Property | Operator set |
162162
| -------- | -------- |
163-
| - **Title**<br>- **Description**<br>- All listed **entity properties** | - Equals/Does not equal<br>- Contains/Does not contain<br>- Starts with/Does not start with<br>- Ends with/Does not end with |
163+
| - **Title**<br>- **Description**<br>- All listed **entity properties**<br>&nbsp;&nbsp;(see [supported entity properties](automate-incident-handling-with-automation-rules.md#supported-entity-properties)) | - Equals/Does not equal<br>- Contains/Does not contain<br>- Starts with/Does not start with<br>- Ends with/Does not end with |
164164
| - **Tag** (See [individual vs. collection](automate-incident-handling-with-automation-rules.md#tag-property-individual-vs-collection)) | **Any individual tag:**<br>- Equals/Does not equal<br>- Contains/Does not contain<br>- Starts with/Does not start with<br>- Ends with/Does not end with<br><br>**Collection of all tags:**<br>- Contains/Does not contain |
165165
| - **Tag** (in addition to above)<br>- **Alerts**<br>- **Comments** | - Added |
166166
| - **Severity**<br>- **Status** | - Equals/Does not equal<br>- Changed<br>- Changed from<br>- Changed to |

0 commit comments

Comments
 (0)