New to SecOps and I am creating a detection rule based on MS Defender events. I'd like to set the severity of the detection based on the severity from Defender. Can a variable be used in the meta section?
meta:
author = "JAB"
id = "asdfasdfasdf"
severity = "$Severity"
I created the $Severity variable in the outcomes section. Any ideas or suggestions?
