Cyble Vision Alerts Vulnerability

Back


Id	0e0cdda9-4536-4cc9-91cf-736e8957ed26
Rulename	Cyble Vision Alerts Vulnerability
Description	Detects SSL/TLS and application vulnerabilities from CybleVision. Extracts host, IP, port, severity, vulnerability ID and first-seen metadata using the Alerts_Vulnerability parser. Incidents grouped per service.
Severity	Low
Tactics	Reconnaissance Execution Discovery
Techniques	T1595 T1203 T1046
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Vulnerability.yaml
Version	1.0.0
Arm template	0e0cdda9-4536-4cc9-91cf-736e8957ed26.json

KQL

Alerts_vulnerability 
| where Service == "vulnerability" 
| extend MappedSeverity = Severity

YAML

incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    matchingMethod: AllEntities
    lookbackDuration: PT5H
    reopenClosedIncident: false
    enabled: false
requiredDataConnectors:
- dataTypes:
  - CybleVisionAlerts_CL
  connectorId: CybleVisionAlerts
relevantTechniques:
- T1595
- T1203
- T1046
triggerOperator: GreaterThan
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Vulnerability.yaml
customDetails:
  AlertID: AlertID
  V_Confidence: V_Confidence
  V_FirstSeen: V_FirstSeen
  Service: Service
  V_Type: V_Type
  V_LastSeen: V_LastSeen
  Status: Status
  V_Port: V_Port
  Title: V_Title
  V_VulnID: V_VulnID
  MappedSeverity: Severity
queryFrequency: 30m
severity: Low
subTechniques: []
triggerThreshold: 0
suppressionDuration: PT5H
entityMappings:
- fieldMappings:
  - columnName: V_Host
    identifier: HostName
  entityType: Host
- fieldMappings:
  - columnName: V_IP
    identifier: Address
  entityType: IP
alertDetailsOverride:
  alertDynamicProperties: []
  alertDescriptionFormat: |
        A vulnerability was detected for host {{V_Host}} (IP {{V_IP}}, Port {{V_Port}}).
  alertDisplayNameFormat: CybleVision Vulnerability {{V_Title}}
name: Cyble Vision Alerts Vulnerability
query: |
  Alerts_vulnerability 
  | where Service == "vulnerability" 
  | extend MappedSeverity = Severity  
version: 1.0.0
tactics:
- Reconnaissance
- Execution
- Discovery
queryPeriod: 30m
description: |
    'Detects SSL/TLS and application vulnerabilities from CybleVision. Extracts host, IP, port, severity, vulnerability ID and first-seen metadata using the Alerts_Vulnerability parser. Incidents grouped per service.'
kind: Scheduled
id: 0e0cdda9-4536-4cc9-91cf-736e8957ed26
enabled: true
eventGroupingSettings:
  aggregationKind: AlertPerResult
status: Available

ARM