The core requirement is to customize details included when an alert is created for a specific event. In Microsoft Sentinel, the most effective and granular way to enrich, map, and customize alert fields is by using a Scheduled Query Rule within the Analytics section.
Customization for Microsoft Defender Alerts
* Defender for Cloud Data Connector: This connector, categorized as a Microsoft Security rule type, automatically imports alerts and incidents generated by Microsoft Defender for Cloud into the Microsoft Sentinel SecurityAlert table. These imported alerts have a predefined schema and initial set of details.
* Customization Limitation: You cannot modify the alert schema or customize the details directly on the Microsoft Defender for Cloud data connector itself (Option A).
* Scheduled Query Rule for Enrichment: To customize the alert details, an analyst must run a custom Kusto Query Language (KQL) query against the ingested security alerts (in the SecurityAlert table) or related raw log events. This query is packaged within a Scheduled Query Rule (Option C).
The Role of a Scheduled Query Rule
Scheduled query rules provide the necessary Alert enrichment features to customize alert properties:
* Custom Details (Surface Custom Event Details): This feature allows an analyst to pull any field from the KQL query result and display it prominently in the resulting Sentinel alert and incident.
* Customize Alert Details: This feature allows an analyst to override the default properties of the alert, such as:
* Alert Name Format: Dynamically change the alert title to include specific event values (e.g., Alert from {{ProviderName}}: {{AccountName}} failed to sign in to computer
{{ComputerName}}).
* Alert Description Format: Embed custom messages or specific log data into the description.
* AlertSeverity, Tactics, ConfidenceScore, AlertLink, and other key fields: Use values from the query results to set these properties dynamically for each alert instance.
By creating a scheduled query rule that specifically queries the Defender for Cloud alerts and uses KQL to extract or calculate the required custom information, an analyst can then apply the Alert details and Custom details features on the rule's Set rule logic tab to meet the customization requirement.