MDE XSUP-44022 - Correlation Rule Update

Packs/MicrosoftDefenderAdvancedThreatProtection/CorrelationRules/MicrosoftDefenderAdvancedThreatProtection_correlation-rule.yml

@@ -1,24 +1,22 @@
 alert_category: EXECUTION
 alert_description: This alert will trigger in an event where Malware was detected by Microsoft Defender for Endpoints.
 alert_fields:
-  actor_process_image_name:
-  actor_process_image_path: xdm.target.file.path
+  action_local_ip: xdm.target.ipv4
+  actor_effective_username: xdm.source.user.username
   actor_process_command_line: xdm.target.process.command_line
-  agent_device_domain: xdm.source.user.domain
+  actor_process_image_path: xdm.target.file.path
   actor_process_image_sha256: xdm.target.file.sha256
+  agent_device_domain: xdm.source.user.domain
   agent_hostname: xdm.target.host.fqdn
-  action_local_ip: xdm.target.ipv4
-  action_remote_ip:
-  action_remote_port:
-  actor_effective_username: xdm.source.user.username
+  eventid: xdm.event.id
 alert_name: Malware detected by Microsoft Defender for Endpoints
 crontab: '*/10 * * * *'
 dataset: alerts
-description: This alert will trigger in an event where Malware was detected by Microsoft Defender for Endpoints.
+description: Alert will trigger an event when Malware was detected by Microsoft Defender for Endpoints.
 drilldown_query_timeframe: ALERT
 execution_mode: SCHEDULED
-global_rule_id: 6af7a4d0-498c-4d89-804c-655dd14c37ab
-investigation_query_link:
+global_rule_id: e507490a-6573-406f-98a1-91fc28289e2b
+investigation_query_link: ''
 mapping_strategy: CUSTOM
 mitre_defs: {}
 name: Microsoft Defender for Endpoint - Malware Detected

Packs/MicrosoftDefenderAdvancedThreatProtection/ReleaseNotes/1_17_6.md

@@ -0,0 +1,6 @@
+
+#### Correlation Rules
+
+##### Microsoft Defender for Endpoint - Malware Detected
+
+Updated the Correlation Rule logic, added an Alert Field mapping for the **Event ID** field to the **xdm.event.id** field.

Packs/MicrosoftDefenderAdvancedThreatProtection/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Microsoft Defender for Endpoint",
     "description": "Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection (ATP)) is a unified platform for preventative protection, post-breach detection, automated investigation, and response.",
     "support": "xsoar",
-    "currentVersion": "1.17.5",
+    "currentVersion": "1.17.6",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",