{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "CYFIRMA - High Severity Weak Certificate Exposure Detected  - {{Description}}",
          "alertDisplayNameFormat": "CYFIRMA - High Severity Weak Certificate Exposure Detected for this Domain  - {{Domain}}",
          "alertDynamicProperties": [
            {
              "alertProperty": "ProductName",
              "value": "ProductName"
            },
            {
              "alertProperty": "ProviderName",
              "value": "ProviderName"
            }
          ]
        },
        "alertRuleTemplateName": "3b5a1c0e-7f3a-4d47-8416-6c0b8b91e9ce",
        "customDetails": {
          "CertificateData": "CertificateData",
          "CertificateHash": "CertificateHash",
          "Description": "Description",
          "Domain": "Domain",
          "FirstSeen": "FirstSeen",
          "IssuedBy": "IssuedBy",
          "IssuedTo": "IssuedTo",
          "LastSeen": "LastSeen",
          "Protocols": "Protocols",
          "RiskScore": "RiskScore",
          "SelfSigned": "SelfSigned",
          "TimeGenerated": "TimeGenerated",
          "TopDomain": "TopDomain",
          "ValidFrom": "ValidFrom",
          "ValidTo": "ValidTo"
        },
        "description": "\"This alert indicates that a weak or insecure SSL/TLS certificate has been detected on a public-facing asset monitored by Cyfirma. \nSuch certificates do not meet modern encryption standards and are considered insecure, especially for handling sensitive transactions. \nThis exposure increases the risk of man-in-the-middle attacks and loss of data integrity or confidentiality. \nImmediate remediation is advised by replacing weak certificates with strong, industry-compliant ones.\"\n",
        "displayName": "CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "Domain",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "TopDomain",
                "identifier": "HostName"
              },
              {
                "columnName": "Domain",
                "identifier": "DnsDomain"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyfirma%20Attack%20Surface/Analytic%20Rules/ASCertificatesHighRule.yaml",
        "query": "// High Severity Weak Certificate Exposure Detected\nlet timeFrame = 5m;\nCyfirmaASCertificatesAlerts_CL\n| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())\n| extend\n    Description=description,\n    FirstSeen=first_seen,\n    LastSeen=last_seen,\n    ValidFrom=valid_from,\n    ValidTo=valid_to,\n    RiskScore=risk_score,\n    Domain=sub_domain,\n    TopDomain=top_domain,\n    Protocols=protocols,\n    SelfSigned=self_signed,\n    AlertUID=alert_uid,\n    UID=uid,\n    CertificateData= cert_data,\n    CertificateHash=cert_hash,\n    IssuedBy=issued_by,\n    IssuedTo=issued_to,\n    ProviderName='CYFIRMA',\n    ProductName='DeCYFIR/DeTCT'\n| project\n    TimeGenerated,\n    Description,\n    Domain,\n    TopDomain,\n    RiskScore,\n    FirstSeen,\n    LastSeen,\n    ValidFrom,\n    ValidTo,\n    Protocols,\n    SelfSigned,\n    CertificateData,\n    CertificateHash,\n    IssuedBy,\n    IssuedTo,\n    ProviderName,\n    ProductName\n",
        "queryFrequency": "PT5M",
        "queryPeriod": "PT5M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion",
          "InitialAccess",
          "Reconnaissance",
          "ResourceDevelopment"
        ],
        "techniques": [
          "T1190",
          "T1552",
          "T1553",
          "T1588",
          "T1595"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}