adding kind property to exisitng templates

Detections/ASimAuthentication/imAuthBruteForce.yaml

@@ -43,3 +43,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/ASimAuthentication/imAuthPasswordSpray.yaml

@@ -37,3 +37,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/ASimAuthentication/imAuthSigninsMultipleCountries.yaml

@@ -38,4 +38,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.1.0
-
+kind: scheduled

Detections/ASimAuthentication/imSigninAttemptsByIPviaDisabledAccounts.yaml

@@ -50,3 +50,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/ASimDNS/imDNS_Miners.yaml

@@ -40,3 +40,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.2.0
+kind: scheduled

Detections/ASimDNS/imDNS_TorProxies.yaml

@@ -35,3 +35,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.2.0
+kind: scheduled

Detections/ASimDNS/imDns_DomainEntity_DnsEvents.yaml

@@ -66,3 +66,4 @@ customDetails:
   DnsQuery: DnsQuery
   QueryType: QueryType
 version: 1.0.0
+kind: scheduled

Detections/ASimDNS/imDns_ExcessiveNXDOMAINDNSQueries.yaml

@@ -35,3 +35,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.2.0
+kind: scheduled

Detections/ASimDNS/imDns_HighNXDomainCount_detection.yaml

@@ -49,3 +49,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/ASimDNS/imDns_IPEntity_DnsEvents.yaml

@@ -75,3 +75,4 @@ customDetails:
   SubType: SubType 
   DnsQuery: DnsQuery
 version: 1.0.0
+kind: scheduled

Detections/ASimFileEvent/imFileESolarWindsSunburstSupernova.yaml

@@ -46,3 +46,4 @@ entityMappings:
       - identifier: Value
         columnName: FileHashCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/ASimProcess/imProcess_AdFind_Usage.yaml

@@ -53,3 +53,4 @@ entityMappings:
       - identifier: Value
         columnName: FileHashCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/ASimProcess/imProcess_NOBELIUM_SuspiciousRundll32Exec.yaml

@@ -37,3 +37,4 @@ entityMappings:
       - identifier: FullName
         columnName: HostCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/ASimProcess/imProcess_SolarWinds_SUNBURST_Process-IOCs.yaml

@@ -51,3 +51,4 @@ entityMappings:
       - identifier: Value
         columnName: FileHashCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/ASimProcess/imProcess_base64_encoded_pefile.yaml

@@ -39,3 +39,4 @@ entityMappings:
       - identifier: FullName
         columnName: HostCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/ASimProcess/imProcess_malware_in_recyclebin.yaml

@@ -39,3 +39,4 @@ entityMappings:
       - identifier: FullName
         columnName: HostCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/AWSCloudTrail/AWS_ChangeToRDSDatabase.yaml

@@ -36,3 +36,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AWSCloudTrail/AWS_ChangeToVPC.yaml

@@ -38,3 +38,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AWSCloudTrail/AWS_ClearStopChangeTrailLogs.yaml

@@ -37,3 +37,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AWSCloudTrail/AWS_ConsoleLogonWithoutMFA.yaml

@@ -40,3 +40,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AWSCloudTrail/AWS_CredentialHijack.yaml

@@ -37,3 +37,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AWSCloudTrail/AWS_FullAdminPolicyAttachedToRolesUsersGroups.yaml

@@ -70,3 +70,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AWSCloudTrail/AWS_IngressEgressSecurityGroupChange.yaml

@@ -37,3 +37,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AWSCloudTrail/AWS_LoadBalancerSecGroupChange.yaml

@@ -38,3 +38,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/ADAttacksPathways.yaml

@@ -28,3 +28,4 @@ query: |
   | lookup kind=leftouter SeverityTable on Severity
   | order by Level
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/DCShadow.yaml

@@ -19,3 +19,4 @@ query: |
     afad_parser
     | where MessageType == 2 and Codename == "DCShadow"
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/DCSync.yaml

@@ -19,3 +19,4 @@ query: |
     afad_parser
     | where MessageType == 2 and Codename == "DCSync"
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/GoldenTicket.yaml

@@ -19,3 +19,4 @@ query: |
     afad_parser
     | where MessageType == 2 and Codename == "Golden Ticket"
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/IndicatorsOfAttack.yaml

@@ -27,3 +27,4 @@ query: |
     | lookup kind=leftouter SeverityTable on Severity
     | order by Level
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/IndicatorsOfExposures.yaml

@@ -27,3 +27,4 @@ query: |
     | lookup kind=leftouter SeverityTable on Severity
     | order by Level
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/LSASSMemory.yaml

@@ -19,3 +19,4 @@ query: |
     afad_parser
     | where MessageType == 2 and Codename == "OS Credential Dumping: LSASS Memory"
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/PasswordGuessing.yaml

@@ -19,3 +19,4 @@ query: |
     afad_parser
     | where MessageType == 2 and Codename == "Password Guessing"
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/PasswordIssues.yaml

@@ -28,3 +28,4 @@ query: |
   | lookup kind=leftouter SeverityTable on Severity
   | order by Level
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/PasswordSpraying.yaml

@@ -19,3 +19,4 @@ query: |
     afad_parser
     | where MessageType == 2 and Codename == "Password Spraying"
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/PrivilegedAccountIssues.yaml

@@ -28,3 +28,4 @@ query: |
   | lookup kind=leftouter SeverityTable on Severity
   | order by Level
 version: 1.0.0
+kind: scheduled

Detections/AlsidForAD/UserAccountIssues.yaml

@@ -28,3 +28,4 @@ query: |
   | lookup kind=leftouter SeverityTable on Severity
   | order by Level
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/ADFSDomainTrustMods.yaml

@@ -58,3 +58,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/CredentialAddedAfterAdminConsent.yaml

@@ -67,3 +67,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/FirstAppOrServicePrincipalCredential.yaml

@@ -56,3 +56,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/MailPermissionsAddedToApplication.yaml

@@ -55,3 +55,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/MaliciousOAuthApp_O365AttackToolkit.yaml

@@ -71,3 +71,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/MaliciousOAuthApp_PwnAuth.yaml

@@ -71,3 +71,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/NewAppOrServicePrincipalCredential.yaml

@@ -58,3 +58,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/RareApplicationConsent.yaml

@@ -78,3 +78,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/AuditLogs/SuspiciousOAuthApp_OfflineAccess.yaml

@@ -69,3 +69,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AuditLogs/UseraddedtoPrivilgedGroups.yaml

@@ -58,3 +58,4 @@ entityMappings:
       - identifier: FullName
         columnName: TargetUserPrincipalName
 version: 1.0.1
+kind: scheduled

Detections/AzureActivity/AADHybridHealthADFSNewServer.yaml

@@ -40,3 +40,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureActivity/AADHybridHealthADFSServiceDelete.yaml

@@ -41,3 +41,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureActivity/AADHybridHealthADFSSuspApp.yaml

@@ -46,3 +46,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml

@@ -61,3 +61,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/AzureActivity/Creation_of_Expensive_Computes_in_Azure.yaml

@@ -43,3 +43,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml

@@ -46,3 +46,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/AzureActivity/New-CloudShell-User.yaml

@@ -35,3 +35,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureActivity/NewResourceGroupsDeployedTo.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureActivity/RareOperations.yaml

@@ -51,3 +51,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.1.0
+kind: scheduled

Detections/AzureAppServices/AVScan_Failure.yaml

@@ -20,3 +20,4 @@ entityMappings:
       - identifier: FullName
         columnName: HostCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureAppServices/AVScan_Infected_Files_Found.yaml

@@ -20,3 +20,4 @@ entityMappings:
       - identifier: FullName
         columnName: HostCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ADOAgentPoolCreatedDeleted.yaml

@@ -46,3 +46,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ADOAuditStreamDisabled.yaml

@@ -28,3 +28,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ADONewExtensionAdded.yaml

@@ -31,3 +31,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ADOPATUsedWithBrowser.yaml

@@ -28,3 +28,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ADOPipelineModifiedbyNewUser.yaml

@@ -55,3 +55,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ADORetentionReducedto0.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ADOSecretNotSecured.yaml

@@ -34,3 +34,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ADOVariableModifiedByNewUser.yaml

@@ -43,3 +43,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/AzDOAdminGroupAdditions.yaml

@@ -39,3 +39,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/AzDOHistoricPrPolicyBypassing.yaml

@@ -40,3 +40,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/AzDOHistoricServiceConnectionAdds.yaml

@@ -59,3 +59,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/AzDOPatSessionMisuse.yaml

@@ -42,3 +42,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/AzDOPipelineCreatedDeletedOneDay.yaml

@@ -57,3 +57,4 @@ entityMappings:
       - identifier: Address
         columnName: DeletingIP
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/AzDOServiceConnectionUsage.yaml

@@ -39,3 +39,4 @@ query: |
     strcat('https://dev.azure.com/', OrganizationName, '/', ProjectName, '/_release?_a=releases&view=mine&definitionId=', DefId))
   | extend timestamp = StartTime
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/ExternalUpstreamSourceAddedtoAzureDevOpsFeed.yaml

@@ -45,3 +45,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/NewAgentAddedToPoolbyNewUserorofNewOS.yaml

@@ -62,3 +62,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDevOpsAuditing/NewPAPCAPCASaddedtoADO.yaml

@@ -40,3 +40,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDiagnostics/KeyVaultSensitiveOperations.yaml

@@ -41,3 +41,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDiagnostics/KeyvaultMassSecretRetrieval.yaml

@@ -53,3 +53,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDiagnostics/MaliciousWAFSessions.yaml

@@ -57,3 +57,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureDiagnostics/TimeSeriesKeyvaultAccessAnomaly.yaml

@@ -74,3 +74,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/AzureFirewall/SeveralDenyActionsRegistered.yaml

@@ -44,3 +44,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaConnectionNon-CorporatePrivateNetwork.yaml

@@ -34,3 +34,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaConnectionToUnpopularWebsiteDetected.yaml

@@ -41,3 +41,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml

@@ -32,3 +32,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaEmptyUserAgentDetected.yaml

@@ -32,3 +32,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaHackToolUserAgentDetected.yaml

@@ -80,3 +80,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaPowershellUserAgentDetected.yaml

@@ -33,3 +33,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaRareUserAgentDetected.yaml

@@ -38,3 +38,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaRequestAllowedHarmfulMaliciousURICategory.yaml

@@ -51,3 +51,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaRequestBlocklistedFileType.yaml

@@ -36,3 +36,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/CiscoUmbrella/CiscoUmbrellaURIContainsIPAddress.yaml

@@ -33,3 +33,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniHighRiskBusinessIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniHighRiskFinancialIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniHighRiskGovernanceIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniHighRiskHRIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniHighRiskLegalIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniLowRiskBusinessIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniLowRiskFinancialIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniLowRiskGovernanceIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniLowRiskHRIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniLowRiskLegalIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Detections/Cognni/CognniMediumRiskBusinessIncidents.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled