MDIoT DOS analytic rule entities

Azure · Jan 9, 2025 · b2be59a · b2be59a
1 parent e8a87ea
commit b2be59a
Showing 1 changed file with 3 additions and 9 deletions.
diff --git a/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTDenialofService.yaml b/Solutions/IoTOTThreatMonitoringwithDefenderforIoT/Analytic Rules/IoTDenialofService.yaml
@@ -47,14 +47,8 @@ query: |
     AlertManagementUri,
     Techniques
 entityMappings:
-  - entityType: IP
-    fieldMappings:
-      - identifier: Address
-        columnName: SourceDeviceAddress
-  - entityType: IP
-    fieldMappings:
-      - identifier: Address
-        columnName: DestDeviceAddress
+sentinelEntitiesMappings:
+  - columnName: Entities
 eventGroupingSettings:
   aggregationKind: AlertPerResult
 customDetails:
@@ -78,5 +72,5 @@ alertDetailsOverride:
       value: ProductComponentName
     - alertProperty: AlertLink
       value: AlertLink
-version: 1.0.2
+version: 1.0.3
 kind: Scheduled