Cyble Vision Alerts Docker

Back


Id	47dee28d-fa74-49cd-b5fb-397b047a73c0
Rulename	Cyble Vision Alerts Docker
Description	Detects Docker Hub container entries related to monitored keywords. Uses Alerts_docker parser. Includes metadata such as developer, stars, downloads, and image URL. Raises one incident per alert.
Severity	Low
Tactics	Exfiltration Execution Discovery
Techniques	T1537 T1610 T1083
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Docker.yaml
Version	1.0.0
Arm template	47dee28d-fa74-49cd-b5fb-397b047a73c0.json

KQL

Alerts_docker  
| where Service == "docker" 
| extend MappedSeverity = Severity

YAML

status: Available
enabled: true
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_Docker.yaml
version: 1.0.0
queryPeriod: 30m
query: |
  Alerts_docker  
  | where Service == "docker" 
  | extend MappedSeverity = Severity  
kind: Scheduled
name: Cyble Vision Alerts Docker
triggerOperator: GreaterThan
severity: Low
eventGroupingSettings:
  aggregationKind: AlertPerResult
id: 47dee28d-fa74-49cd-b5fb-397b047a73c0
triggerThreshold: 0
entityMappings:
- entityType: Url
  fieldMappings:
  - identifier: Url
    columnName: DK_Url
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: KeywordName
queryfrequency: 30m
description: |
    'Detects Docker Hub container entries related to monitored keywords. Uses Alerts_docker parser. Includes metadata such as developer, stars, downloads, and image URL. Raises one incident per alert.'
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
incidentConfiguration:
  alertDetailsOverride: 
  createIncident: true
  groupingConfiguration:
    enabled: false
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
  alertDisplayNameFormat: Docker Image Identified {{DK_Title}}
  alertDescriptionFormat: |
        A Docker Hub image related to monitored entity {{KeywordName}} was discovered. Developer {{DK_Developer}}. Downloads {{DK_Downloads}}. Review metadata and verify if the image poses supply chain or impersonation risk.
customDetails:
  DK_Url: DK_Url
  Service: Service
  MappedSeverity: Severity
  DK_Developer: DK_Developer
  DK_Stars: DK_Stars
  DK_description: DK_Description
  Status: Status
  DK_DeveloperUrl: DK_DeveloperUrl
  DK_Title: DK_Title
  AlertID: AlertID
  DK_Downloads: DK_Downloads
relevantTechniques:
- T1537
- T1610
- T1083
tactics:
- Exfiltration
- Execution
- Discovery

ARM