Microsoft Sentinel External Alerts

ELASTIC detection rule by Elastic · Elastic License v2

Generates a detection alert for each Microsoft Sentinel alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Microsoft Sentinel alerts in the app.

[metadata]
creation_date = "2025/07/31"
integration = ["microsoft_sentinel"]
maturity = "production"
promotion = true
updated_date = "2025/10/17"

[rule]
author = ["Elastic"]
description = """
Generates a detection alert for each Microsoft Sentinel alert written to the configured indices. Enabling this rule
allows you to immediately begin investigating Microsoft Sentinel alerts in the app.
"""
from = "now-2m"
index = ["logs-microsoft_sentinel.alert-*"]
interval = "1m"
language = "kuery"
license = "Elastic License v2"
max_signals = 1000
name = "Microsoft Sentinel External Alerts"
note = """ Triage and analysis

## Investigating Microsoft Sentinel External Alerts

Microsoft Sentinel is a cloud-native SIEM tool that aggregates security data for threat detection and response. The rule identifies each alert logged in Sentinel, enabling analysts to swiftly investigate potential threats.

### Possible investigation steps

- Examine the timeline of events leading up to the alert to identify any unusual or suspicious activities that may have occurred.
- Cross-reference the alert with other related alerts or logs in Microsoft Sentinel to determine if this is part of a larger pattern or isolated incident.
- Investigate the source and context of the alert to identify any patterns or anomalies that could indicate manipulation or false positives.
- Consult the Microsoft Sentinel investigation guide and resources tagged in the alert for specific guidance on handling similar threats.

### False positive analysis

- Alerts triggered by routine administrative tasks can be false positives. Identify these tasks and create exceptions to prevent unnecessary alerts.
- Frequent alerts from known safe IP addresses or domains may not indicate a threat. Whitelist these sources to reduce noise.
- Alerts generated by automated scripts or scheduled tasks that are part of regular operations can be excluded by setting up filters for these specific activities.
- Non-threatening alerts from internal network scans or vulnerability assessments should be reviewed and excluded if they are part of regular security practices.
- Alerts from test environments or sandboxed systems can be false positives. Exclude these environments from alert generation to focus on genuine threats.

### Response and remediation

- Contain the threat by isolating affected systems from the network to prevent further spread or data exfiltration.
- Review and terminate any suspicious processes or sessions identified in the alert to halt ongoing malicious activities.
- Conduct a thorough analysis of the alert details to identify any compromised accounts or credentials and reset passwords immediately.
- Apply relevant security patches or updates to affected systems to close any vulnerabilities exploited by the adversary.
- Restore affected systems from clean backups to ensure the integrity and security of the environment.
- Monitor network traffic and system logs closely for any signs of recurring or related suspicious activities.
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional resources are needed.
"""
references = ["https://docs.elastic.co/en/integrations/microsoft_sentinel"]
risk_score = 47
rule_id = "74147312-ba03-4bea-91d1-040d54c1e8c3"
rule_name_override = "microsoft_sentinel.alert.properties.friendly_name"
setup = """## Setup

### Microsoft Sentinel Alert Integration
This rule is designed to capture alert events generated by the Microsoft Sentinel integration and promote them as Elastic detection alerts.

To capture Microsoft Sentinel alerts, install and configure the Microsoft Sentinel integration to ingest alert events into the `logs-microsoft_sentinel.alert-*` index pattern.

If this rule is enabled alongside the External Alerts promotion rule (UUID: eb079c62-4481-4d6e-9643-3ca499df7aaa), you may receive duplicate alerts for the same Sentinel events. Consider adding a rule exception for the External Alert rule to exclude data_stream.dataset:microsoft_sentinel.alert to avoid receiving duplicate alerts.

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "medium"
tags = [
    "Data Source: Microsoft Sentinel",
    "Use Case: Threat Detection",
    "Resources: Investigation Guide",
    "Promotion: External Alerts",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.kind: alert and data_stream.dataset: microsoft_sentinel.alert
'''


[[rule.risk_score_mapping]]
field = "microsoft_sentinel.alert.properties.confidence_score"
operator = "equals"
value = ""

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "low"
value = "21"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "medium"
value = "47"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "high"
value = "73"

[[rule.severity_mapping]]
field = "event.severity"
operator = "equals"
severity = "critical"
value = "99"

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

016f5edc-5283-48dd-a465-f398076a7159

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion