[QUESTION] RelatedAlerts filter out MITRE scoring

[mikedizzle]

Is there a way to filter out the MITRE tactics from being scored in the Get-RelatedAlerts module?

[briandelmsft]

It's possible, but will require a manual manipulation of the Related Alerts module output before passing it to the scoring module. To bypass the scoring, you will need to change the 'AllTacticsCount' to 0 before passing it to the scoring module.

To do this, after the related alerts module runs, add a compose step to the logic app and in the compose step add the following using the expression editor:

setProperty(body('Related_Alerts_Module'),'AllTacticsCount',0)

You may need to change the Related_Alerts_Module part if your step name for this module has been changed from the default.

Then when you pass the related alerts body to the scoring module, pass the compose output in place of the Related Alerts Module Body.

It should look something like this:

[mikedizzle]

Excellent. Thank you for this. I'm going to create a feature request to have this available as a parameter in the related alerts mod action. I'll do this in the meantime.