Forum Discussion
Grouping alert into incident
@Clive_Watson
Hello all
I have a query regarding the alert grouping in sentinel . For one of the out of the box rules I deployed which runs every hour, I have added alert grouping into one incident for 24 hour if the defined entity matches but this is not working as expected. Even though the entity matched this rule is creating new incident every hour.
I have used following fields for entity matching under alert enhancement section
- OperationNameList - This will have list of operations that triggered the alert.
- CallerObjectId - This is the account that performed the action
- CallerIPMax – This is most recent IP from which this operation was performed.
Even operation list was also same and in same order. Operationlist field have set of values so Can this prevent it from being grouped into one incident? Does anyone know any reason for it to be not grouping the alert into one incident. Any suggestions would be appreciated.
Thank you
6 Replies
Hello Raphael,
Thank you for the reply. I cannot add the rule in full here because of some client information in the rule. but most of the part of the rule is from out of the box sentinel rule called Mass Secret Retrieval From Azure Key Vault. For entity mapping in sentinel we have used following fields
- OperationNameList - This will have list of operations that triggered the alert.
- CallerObjectId - This is the account that performed the action
- CallerIPMax – This is most recent IP from which this operation was performed.
We have done following settings :
Under incident settings we have done following settings:
Even though all the entity are matching this rule is creating incident every hour and not grouping then into incident.
- burasathi
hello
you are using to group when it matches account, id , process. As the ip and the process will always be different, then there will always be a non-grouped incident because it does not match the selected fields.
Select last option and mark account
About the alerts it is generating too many and because you are evaluating every hour with 1 day data polling time, try to run every 1 hour with 1 hour polling time.
if you liked it mark the answer with a like.
if you thought this answer helped in any way please mark it as best answer
