GTI - Critical CVSS Score Vulnerability Detected | Microsoft Sentinel Analytic Rules

Back


Id	3794141b-9bd3-41ae-8303-79f97692998b
Rulename	GTI - Critical CVSS Score Vulnerability Detected
Description	Detects vulnerabilities ingested from Google Threat Intelligence with a CVSS v3 base score at or above the critical threshold (9.0). Uses explicit Cvssv3xBaseScore and Cvssv3xTranslatedBaseScore fields from the GTIVulnerabilities parser. Fires when a matching record is found, indicating a critically rated vulnerability that warrants immediate analyst review.
Severity	High
Tactics	InitialAccess Execution PrivilegeEscalation Impact
Techniques	T1190 T1068 T1203
Required data connectors	GTIVulnerabilitiesConnector
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_CriticalCVSSVulnerability.yaml
Version	1.0.0
Arm template	3794141b-9bd3-41ae-8303-79f97692998b.json

KQL

GTIVulnerabilities
| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
| where isnotempty(Cvssv3Score) and Cvssv3Score >= 9.0
| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )
| project
    TimeGenerated,
    CveId,
    VulnName,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    RiskRating,
    Priority,
    ExploitationState,
    ExploitationConsequence,
    Cvssv4xThreatExploitMaturity,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

YAML

relevantTechniques:
- T1190
- T1068
- T1203
triggerThreshold: 0
id: 3794141b-9bd3-41ae-8303-79f97692998b
eventGroupingSettings:
  aggregationKind: AlertPerResult
queryPeriod: 10m
triggerOperator: gt
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    matchingMethod: Selected
    groupByCustomDetails:
    - CveId
    lookbackDuration: P1D
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI Critical CVSS: {{CveId}} (Score: {{Cvssv3Score}})'
  alertDescriptionFormat: 'CVE: {{CveId}} | CVSS v3: {{Cvssv3Score}} | Risk: {{RiskRating}}'
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_CriticalCVSSVulnerability.yaml
queryFrequency: 10m
requiredDataConnectors:
- dataTypes:
  - GTI_Vulnerabilities_CL
  connectorId: GTIVulnerabilitiesConnector
version: 1.0.0
tactics:
- InitialAccess
- Execution
- PrivilegeEscalation
- Impact
query: |
  GTIVulnerabilities
  | extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
  | where isnotempty(Cvssv3Score) and Cvssv3Score >= 9.0
  | extend
      Vendor       = tostring(Cpes[0].start_cpe.vendor),
      Product      = tostring(Cpes[0].start_cpe.product),
      CpeVersion   = tostring(Cpes[0].start_cpe.version),
      VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
  | mv-apply _c = Cpes on (
      where isnotnull(_c.start_cpe)
      | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                  AffectedProducts = make_set(tostring(_c.start_cpe.product))
    )
  | project
      TimeGenerated,
      CveId,
      VulnName,
      Cvssv3Score,
      Cvssv4xScore,
      EpssScore,
      EpssPercentile,
      RiskRating,
      Priority,
      ExploitationState,
      ExploitationConsequence,
      Cvssv4xThreatExploitMaturity,
      Vendor,
      Product,
      CpeVersion,
      AffectedVendors,
      AffectedProducts,
      Description,
      VendorFixUrl,
      VendorFixReferences,
      Tags,
      Type
name: GTI - Critical CVSS Score Vulnerability Detected
severity: High
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: VendorFixUrl
customDetails:
  AffectedProduct: Product
  CveId: CveId
  AffectedVendor: Vendor
  Cvssv3Score: Cvssv3Score
  RiskRating: RiskRating
  EpssScore: EpssScore
  Priority: Priority
  Cvssv4Score: Cvssv4xScore
  ExploitMaturity: Cvssv4xThreatExploitMaturity
  EpssPercentile: EpssPercentile
  ExploitState: ExploitationState
description: |
  Detects vulnerabilities ingested from Google Threat Intelligence with a CVSS v3 base score at or
  above the critical threshold (9.0). Uses explicit Cvssv3xBaseScore and Cvssv3xTranslatedBaseScore
  fields from the GTIVulnerabilities parser. Fires when a matching record is found, indicating a
  critically rated vulnerability that warrants immediate analyst review.
kind: Scheduled

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3794141b-9bd3-41ae-8303-79f97692998b')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3794141b-9bd3-41ae-8303-79f97692998b')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "CVE: {{CveId}} | CVSS v3: {{Cvssv3Score}} | Risk: {{RiskRating}}",
          "alertDisplayNameFormat": "GTI Critical CVSS: {{CveId}} (Score: {{Cvssv3Score}})"
        },
        "alertRuleTemplateName": "3794141b-9bd3-41ae-8303-79f97692998b",
        "customDetails": {
          "AffectedProduct": "Product",
          "AffectedVendor": "Vendor",
          "CveId": "CveId",
          "Cvssv3Score": "Cvssv3Score",
          "Cvssv4Score": "Cvssv4xScore",
          "EpssPercentile": "EpssPercentile",
          "EpssScore": "EpssScore",
          "ExploitMaturity": "Cvssv4xThreatExploitMaturity",
          "ExploitState": "ExploitationState",
          "Priority": "Priority",
          "RiskRating": "RiskRating"
        },
        "description": "Detects vulnerabilities ingested from Google Threat Intelligence with a CVSS v3 base score at or\nabove the critical threshold (9.0). Uses explicit Cvssv3xBaseScore and Cvssv3xTranslatedBaseScore\nfields from the GTIVulnerabilities parser. Fires when a matching record is found, indicating a\ncritically rated vulnerability that warrants immediate analyst review.\n",
        "displayName": "GTI - Critical CVSS Score Vulnerability Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "VendorFixUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "CveId"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_CriticalCVSSVulnerability.yaml",
        "query": "GTIVulnerabilities\n| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)\n| where isnotempty(Cvssv3Score) and Cvssv3Score >= 9.0\n| extend\n    Vendor       = tostring(Cpes[0].start_cpe.vendor),\n    Product      = tostring(Cpes[0].start_cpe.product),\n    CpeVersion   = tostring(Cpes[0].start_cpe.version),\n    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))\n| mv-apply _c = Cpes on (\n    where isnotnull(_c.start_cpe)\n    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),\n                AffectedProducts = make_set(tostring(_c.start_cpe.product))\n  )\n| project\n    TimeGenerated,\n    CveId,\n    VulnName,\n    Cvssv3Score,\n    Cvssv4xScore,\n    EpssScore,\n    EpssPercentile,\n    RiskRating,\n    Priority,\n    ExploitationState,\n    ExploitationConsequence,\n    Cvssv4xThreatExploitMaturity,\n    Vendor,\n    Product,\n    CpeVersion,\n    AffectedVendors,\n    AffectedProducts,\n    Description,\n    VendorFixUrl,\n    VendorFixReferences,\n    Tags,\n    Type\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Impact",
          "InitialAccess",
          "PrivilegeEscalation"
        ],
        "techniques": [
          "T1068",
          "T1190",
          "T1203"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}