Generic MSSP Alert Tracking and Deduplication
This rule tracks and deduplicates alert emails from a Managed Security Service Provider (MSSP). It identifies emails from a specific sender, filters by subject keywords (e.g., severity levels), and groups them into sessions to prevent duplicate alerts. It also extracts case numbers from portal URLs found within the emails.
Microsoft Sentinel (KQL)
