<group name="microsoft_defender,">
  <rule id="109000" level="3">
    <location>microsoft_defender</location>
    <description>$(microsoft_defender.id) $(microsoft_defender.title).</description>
    <options>no_full_log</options>
  </rule>
  <rule id="109001" level="3">
    <if_sid>109000</if_sid>
    <field name="query">alerts</field>
    <description>List Alerts.</description>
    <options>no_full_log</options>
  </rule>
  <rule id="109002" level="3">
    <if_sid>109001</if_sid>
    <field name="microsoft_defender.severity">Informational</field>
    <description>$(microsoft_defender.severity) Alert: $(microsoft_defender.title).</description>
    <options>no_full_log</options>
    <group>alert,</group>
  </rule>
  <rule id="109003" level="5">
    <if_sid>109001</if_sid>
    <field name="microsoft_defender.severity">Low</field>
    <description>$(microsoft_defender.severity) Alert: $(microsoft_defender.title).</description>
    <options>no_full_log</options>
    <group>alert,</group>
  </rule>
  <rule id="109004" level="10">
    <if_sid>109001</if_sid>
    <field name="microsoft_defender.severity">Medium</field>
    <description>$(microsoft_defender.severity) Alert: $(microsoft_defender.title).</description>
    <options>no_full_log</options>
    <group>alert,</group>
  </rule>
  <rule id="109005" level="12">
    <if_sid>109001</if_sid>
    <field name="microsoft_defender.severity">High</field>
    <description>$(microsoft_defender.severity) Alert: $(microsoft_defender.title).</description>
    <options>no_full_log</options>
    <group>alert,</group>
  </rule>
  
  <rule id="109010" level="12">
    <if_sid>109000</if_sid>
    <field name="query">indicators</field>
    <description>List Indicators.</description>
    <options>no_full_log</options>
  </rule>
  <rule id="109011" level="3">
    <if_sid>109000</if_sid>
    <field name="query">machines</field>
    <description>$(microsoft_defender.computerDnsName) Health Status $(microsoft_defender.healthStatus).</description>
    <options>no_full_log</options>
  </rule>
  <rule id="109012" level="3">
    <if_sid>109000</if_sid>
    <field name="query">domain</field>
    <description>List Domain.</description>
    <options>no_full_log</options>
  </rule>
  <rule id="109013" level="3">
    <if_sid>109000</if_sid>
    <field name="query">recommendations</field>
    <description>$(microsoft_defender.recommendationName).</description>
    <options>no_full_log</options>
  </rule>
  <rule id="109014" level="3">
    <if_sid>109000</if_sid>
    <field name="query">exposurescore</field>
    <description>Domain Exposure Score: $(microsoft_defender.score).</description>
    <options>no_full_log</options>
  </rule>
  <rule id="109015" level="3">
    <if_sid>109000</if_sid>
    <field name="query">software</field>
    <description>$(microsoft_defender.name).</description>
    <options>no_full_log</options>
  </rule>
  <rule id="109016" level="3">
    <if_sid>109000</if_sid>
    <field name="query">vulnerabilities</field>
    <description>$(microsoft_defender.severity) Vulnerability: $(microsoft_defender.productName).</description>
    <options>no_full_log</options>
  </rule>
</group>
