Defender Xdr Alert Evidence Summarized

KQL detection rule by ep3p · MIT

No description provided

AlertEvidence
| where Timestamp > ago(1d)
| where AlertId == "<<<>>>"
| extend AdditionalFields = bag_remove_keys(todynamic(AdditionalFields), dynamic(["MergeByKey", "MergeByKeyHex"]))
| extend AdditionalFieldsType = iff(EntityType == "GenericEntity", tostring(AdditionalFields["Type"]), "")
| extend AllInfo = bag_remove_keys(pack_all(true), dynamic(["Timestamp", "Title", "Severity", "Categories", "AttackTechniques", "ServiceSource", "DetectionSource", "AlertId","EntityType"]))
| extend Packed = bag_remove_keys(AllInfo, dynamic(["EvidenceRole", "EvidenceDirection", "AdditionalFields", "AdditionalFieldsType"]))
| extend PackedKeys = bag_keys(Packed)
| summarize
    AllInfo = make_set(AllInfo),
    EntityList = make_set_if(Packed, array_length(PackedKeys) > 0),
    EntityKeys = make_set_if(PackedKeys, array_length(PackedKeys) > 0),
    take_any(Timestamp, Title, Severity, Categories, AttackTechniques, ServiceSource, DetectionSource)
    by AlertId, EntityType
| summarize
    AllInfo = make_bag(bag_pack(EntityType, AllInfo)),
    BagToUnpack = make_bag_if(bag_pack(EntityType, EntityList), array_length(EntityKeys) > 0),
    ColumnKeys = make_bag_if(bag_pack(EntityType, EntityKeys), array_length(EntityKeys) > 0),
    take_any(Timestamp, Title, Severity, Categories, AttackTechniques, ServiceSource, DetectionSource)
    by AlertId
| extend EntityColumns = bag_keys(BagToUnpack)
| evaluate bag_unpack(BagToUnpack)
| project-reorder Timestamp, AlertId, ServiceSource, DetectionSource, Title, Severity, Categories, AttackTechniques, EntityColumns, ColumnKeys

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0c22006f-1baa-477a-ac53-ceab9dea0921

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion