High Number of Urgent Vulnerabilities Detected

Back


Id	3edb7215-250b-40c0-8b46-79093949242d
Rulename	High Number of Urgent Vulnerabilities Detected
Description	This Creates an incident when a host has a high number of Urgent, severity 5, vulnerabilities detected.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190
Required data connectors	QualysVMLogsCCPDefinition
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/QualysVM/Analytic Rules/HighNumberofVulnDetectedV2.yaml
Version	1.0.3
Arm template	3edb7215-250b-40c0-8b46-79093949242d.json

KQL

let threshold = 10;
QualysHostDetection
| where Severity == "5"
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by NetBios, IPAddress
| where count_ >= threshold

YAML

severity: Medium
queryFrequency: 1h
description: |
    'This Creates an incident when a host has a high number of Urgent, severity 5, vulnerabilities detected.'
query: |
  let threshold = 10;
  QualysHostDetection
  | where Severity == "5"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by NetBios, IPAddress
  | where count_ >= threshold  
requiredDataConnectors:
- connectorId: QualysVMLogsCCPDefinition
  dataTypes:
  - QualysHostDetection
kind: Scheduled
status: Available
name: High Number of Urgent Vulnerabilities Detected
relevantTechniques:
- T1190
tactics:
- InitialAccess
version: 1.0.3
id: 3edb7215-250b-40c0-8b46-79093949242d
triggerThreshold: 0
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/QualysVM/Analytic Rules/HighNumberofVulnDetectedV2.yaml
triggerOperator: gt
entityMappings:
- fieldMappings:
  - columnName: NetBios
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: IPAddress
    identifier: Address
  entityType: IP

ARM