Forum Discussion
Automation rule based on a specific Security Alert
Yes you can apply automation rule to specific alert none the less if security alert is generating from Identity Protection.
Thanks 🙂
Dear Ankit,.
can you please explain me how can I do that?
When I create the new automation rule, I cannot select the "Security Alert" family in the conditions.
I want to create an automation rule that occures everytime I hit the Security Alert "User compromised in AiTM phishing attack".
Thank you!
Luca
Hi,
I'd be happy to help you with creating an automation rule that triggers on a specific Security Alert.
Trigger and Conditions
To create an automation rule that occurs every time you hit a specific Security Alert, you need to select the correct trigger and conditions.
You should select the When an Incident is created trigger and then define the conditions using the Analytic rule name property.Why "Security Alert" Family is Not Available
As these alerts are generated by Defender for Endpoint that's the reason these are not showing in SecurityAlerts table as like alerts being generated by Identity Protection.
Solution:
You have to create an scheduled or NRT analytic rule so that you can select that in condition.
Select the When an alert is created trigger.
Add a condition using the Analytic rule name property.
Select Contains as the operator.
Enter the exact name of the Security Incident you want to trigger the automation rule, such as "User compromised in AiTM phishing attack".Let me know if you have any question.
Thanks