adding kind to all analytic rules under solutions (including duplicated ciscoUmbrealla templates)

Solutions/AristaAwakeSecurity/Analytic Rules/HighMatchCountsByDevice.yaml

@@ -62,3 +62,4 @@ incidentConfiguration:
     groupByCustomDetails:
       - Device
 version: 1.0.0
+kind: scheduled

Solutions/AristaAwakeSecurity/Analytic Rules/HighSeverityMatchesByDevice.yaml

@@ -60,3 +60,4 @@ incidentConfiguration:
     groupByCustomDetails:
       - Device
 version: 1.0.0
+kind: scheduled

Solutions/AristaAwakeSecurity/Analytic Rules/ModelMatchesWithMultipleDestinationsByDevice.yaml

@@ -60,3 +60,4 @@ incidentConfiguration:
     groupByCustomDetails:
       - Device
 version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxAbnormalUserActivity.yaml

@@ -50,3 +50,4 @@ entityMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxBinaryFile.yaml

@@ -24,4 +24,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxDownloadForbiddenFiles.yaml

@@ -32,4 +32,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxInactiveUserLogin.yaml

@@ -37,4 +37,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxItemSharedToExternalUser.yaml

@@ -27,4 +27,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxMultipleItemsDeletedByUser.yaml

@@ -27,4 +27,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxNewExternalUser.yaml

@@ -33,4 +33,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxSensitiveFile.yaml

@@ -29,4 +29,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxUserLoginAsAdmin.yaml

@@ -36,4 +36,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Box/Analytic Rules/BoxUserRoleChangedToOwner.yaml

@@ -37,4 +37,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISEAdminPasswordReset.yaml

@@ -33,4 +33,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISEAttempDeleteLocalStoreLogs.yaml

@@ -35,4 +35,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: HostCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISEBackupFailed.yaml

@@ -28,4 +28,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISECertExpired.yaml

@@ -35,4 +35,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: HostCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISECmdExecutionWithHighestPrivilegesNewIP.yaml

@@ -42,4 +42,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISECmdExecutionWithHighestPrivilegesNewUser.yaml

@@ -42,4 +42,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISEDeviceChangedIP.yaml

@@ -36,4 +36,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISEDevicePostureStatusChanged.yaml

@@ -33,4 +33,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISELogCollectorSuspended.yaml

@@ -25,4 +25,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cisco ISE/Analytic Rules/CiscoISELogsDeleted.yaml

@@ -35,4 +35,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: HostCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaConnectionNon-CorporatePrivateNetwork.yaml

@@ -50,4 +50,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaConnectionToUnpopularWebsiteDetected.yaml

@@ -40,4 +40,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml

@@ -31,4 +31,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaEmptyUserAgentDetected.yaml

@@ -31,4 +31,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaHackToolUserAgentDetected.yaml

@@ -79,4 +79,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaPowershellUserAgentDetected.yaml

@@ -32,4 +32,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaRareUserAgentDetected.yaml

@@ -37,4 +37,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaRequestAllowedHarmfulMaliciousURICategory.yaml

@@ -50,4 +50,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaRequestBlocklistedFileType.yaml

@@ -35,4 +35,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CiscoUmbrella/Analytic Rules/CiscoUmbrellaURIContainsIPAddress.yaml

@@ -32,4 +32,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareBadClientIp.yaml

@@ -31,4 +31,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: UrlCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareEmptyUA.yaml

@@ -25,4 +25,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareMultipleErrorsSource.yaml

@@ -28,4 +28,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareMultipleUAs.yaml

@@ -28,4 +28,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedCountry.yaml

@@ -31,4 +31,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: UrlCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedPost.yaml

@@ -32,3 +32,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedRequest.yaml

@@ -27,4 +27,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareUnexpectedUrl.yaml

@@ -27,4 +27,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareWafThreatAllowed.yaml

@@ -31,4 +31,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: UrlCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Cloudflare/Analytic Rules/CloudflareXSSProbingPattern.yaml

@@ -34,3 +34,4 @@ entityMappings:
       - identifier: Url
         columnName: UrlCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Contrast Security/Analytic Rules/ContrastBlocks.yaml

@@ -58,3 +58,4 @@ entityMappings:
       - identifier: Category
         columnName: Rule
 version: 1.0.0
+kind: scheduled

Solutions/Contrast Security/Analytic Rules/ContrastExploits.yaml

@@ -58,3 +58,4 @@ entityMappings:
       - identifier: Category
         columnName: Rule
 version: 1.0.0
+kind: scheduled

Solutions/Contrast Security/Analytic Rules/ContrastProbes.yaml

@@ -58,3 +58,4 @@ entityMappings:
       - identifier: Category
         columnName: Rule
 version: 1.0.0
+kind: scheduled

Solutions/Contrast Security/Analytic Rules/ContrastSuspicious.yaml

@@ -58,3 +58,4 @@ entityMappings:
       - identifier: Category
         columnName: Rule 
 version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightC2RepetitiveFailures.yaml

@@ -30,3 +30,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightExternalProxyDetected.yaml

@@ -27,4 +27,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightForcedExternalOutboundSMB.yaml

@@ -28,3 +28,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightMultipleCompressedFilesTransferredOverHTTP.yaml

@@ -31,3 +31,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightMultipleFilesSentOverHTTPAbnormalRequests.yaml

@@ -33,3 +33,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightNetworkServiceScanning.yaml

@@ -32,3 +32,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightPossibleWebshell.yaml

@@ -31,3 +31,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightPossibleWebshellRarePOST.yaml

@@ -34,3 +34,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightSMTPEmailSubjectNonAsciiCharacters.yaml

@@ -32,4 +32,5 @@ entityMappings:
     fieldMappings:
       - identifier: Recipient
         columnName: MailCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Corelight/Analytic Rules/CorelightTypoSquattingOrPunycodePhishingHTTPRequest.yaml

@@ -27,4 +27,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml

@@ -48,4 +48,5 @@ entityMappings:
         columnName: MD5
       - identifier: Value
         columnName: FileHashCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml

@@ -40,4 +40,5 @@ entityMappings:
         columnName: MD5
       - identifier: Value
         columnName: FileHashCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/AccessControlControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/Audit&AccountabilityControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/ConfigurationManagementControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/Identification&AuthenticationControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/IncidentResponseControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/RecoveryControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/RiskManagementControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/SecurityAssessmentControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/System&CommunicationsProtectionControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/CybersecurityMaturityModelCertification(CMMC)/Analytic Rules/System&InformationIntegrityControlFamilyMonitoring.yaml

@@ -47,3 +47,4 @@ entityMappings:
       - identifier: Url
         columnName: URLCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/Dynamics 365/Analytic Rules/DynamicsEncryptionSettingsChanged.yaml

@@ -31,4 +31,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: IPCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Dynamics 365/Analytic Rules/MassExportOfDynamicstoExcel.yaml

@@ -50,4 +50,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Dynamics 365/Analytic Rules/NewDynamicsAdminActivity.yaml

@@ -35,4 +35,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Dynamics 365/Analytic Rules/NewDynamicsUserAgent.yaml

@@ -43,4 +43,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Dynamics 365/Analytic Rules/NewOfficeUserAgentinDynamics.yaml

@@ -34,4 +34,5 @@ query: |
   on UserAgent
   | summarize MostRecentActivity=max(TimeGenerated), IPs=make_set(IPAddress), Users=make_set(UserId), Actions=make_set(OriginalObjectId) by UserAgent
   | extend timestamp = MostRecentActivity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/Dynamics 365/Analytic Rules/UserBulkRetreivalOutsideNormalActivity.yaml

@@ -53,4 +53,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: AccountCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/ESETPROTECT/Analytic Rules/ESETThreatDetected.yaml

@@ -38,4 +38,5 @@ entityMappings:
         columnName: FileHashAlgo
       - identifier: Value
         columnName: FileHashCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/ESETPROTECT/Analytic Rules/ESETWebsiteBlocked.yaml

@@ -41,4 +41,5 @@ entityMappings:
     fieldMappings:
       - identifier: Url
         columnName: URLCustomEntity
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/AzureADRareUserAgentAppSignin.yaml

@@ -102,4 +102,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: UserPrincipalName
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/AzureADUserAgentOSmissmatch.yaml

@@ -65,4 +65,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: UserPrincipalName
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/COMHijacking.yaml

@@ -42,4 +42,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/CertutilIngressToolTransfer.yaml

@@ -57,4 +57,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/CreateProcessWithToken.yaml

@@ -59,4 +59,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/DCOMLateralMovement.yaml

@@ -59,4 +59,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: DCOMCmdLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/DLLSideLoading.yaml

@@ -53,4 +53,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/DisableOrModifyWindowsDefender.yaml

@@ -43,4 +43,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/DotNetToJScript.yaml

@@ -37,4 +37,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: InitiatingProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/ExpiredAccessCredentials.yaml

@@ -53,4 +53,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: FailedIp
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/MatchLegitimateNameOrLocation.yaml

@@ -57,4 +57,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/OfficeASRFromBrowser.yaml

@@ -43,4 +43,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/OfficeProcessInjection.yaml

@@ -42,4 +42,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: InitiatingProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/PasswordSprayingWithMDE.yaml

@@ -46,4 +46,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/RecognizingBeaconingTraffic.yaml

@@ -75,4 +75,5 @@ entityMappings:
     fieldMappings:
       - identifier: FullName
         columnName: SourceUserName
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/RemoteDesktopProtocol.yaml

@@ -44,4 +44,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/RenameSystemUtilities.yaml

@@ -48,4 +48,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/SMBWindowsAdminShares.yaml

@@ -88,4 +88,5 @@ entityMappings:
     fieldMappings:
       - identifier: Address
         columnName: RemoteIP
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/SuspiciousParentProcessRelationship.yaml

@@ -45,4 +45,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/FalconFriday/Analytic Rules/TrustedDeveloperUtilitiesProxyExecution.yaml

@@ -43,4 +43,5 @@ entityMappings:
     fieldMappings:
       - identifier: CommandLine
         columnName: ProcessCommandLine
-version: 1.0.0
+version: 1.0.0
+kind: scheduled

Solutions/GoogleCloudPlatformIAM/Analytic Rules/GCPIAMDisableDataAccessLogging.yaml

@@ -31,3 +31,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/GoogleCloudPlatformIAM/Analytic Rules/GCPIAMEmptyUA.yaml

@@ -29,3 +29,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled

Solutions/GoogleCloudPlatformIAM/Analytic Rules/GCPIAMHighPrivilegedRoleAdded.yaml

@@ -35,3 +35,4 @@ entityMappings:
       - identifier: Address
         columnName: IPCustomEntity
 version: 1.0.0
+kind: scheduled