BrandImpersonationHIGH.yaml

id: bf93bd26-cad8-40a3-bde0-71acb874d595
name: Brand Impersonation - HIGH
description: |
  'New brand_impersonation with severity High found'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CBSPollingIDAzureFunctions
    dataTypes:
      - CBSLog_Azure_1_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
query: |+
  CBSLog_Azure_1_CL | where severity_s == "High" | where type_s == "Brand Impersonation" | where status_s != "Closed" or status_s != "Resolved" | where remarks_s == "New brand_impersonation with severity High found"
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
    groupByEntities: []
    groupByAlertDetails: []
    groupByCustomDetails: []
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: subject_s
suppressionDuration: 5h
version: 1.0.1
kind: Scheduled