GTI - CISA Known Exploited Vulnerability Detected | Microsoft Sentinel Analytic Rules

Back


Id	650429cd-afc6-41a5-90e7-6e4a85b2335d
Rulename	GTI - CISA Known Exploited Vulnerability Detected
Description	Detects vulnerabilities ingested from Google Threat Intelligence that are in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed active exploitation and mandated remediation for federal agencies. Uses the explicit CisaKnownExploited field from the GTIVulnerabilities parser, with Tags-based fallback for coverage.
Severity	High
Tactics	InitialAccess Execution Impact
Techniques	T1190 T1203
Required data connectors	GTIVulnerabilitiesConnector
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_CISAKnownExploitedVulnerability.yaml
Version	1.0.0
Arm template	650429cd-afc6-41a5-90e7-6e4a85b2335d.json

KQL

GTIVulnerabilities
| where isnotempty(CisaKnownExploited)
    or isnotempty(CisaKnownExploitedDueDate)
    or isnotempty(CisaKnownExploitedAddedDate)
    or isnotempty(CisaKnownExploitedRansomwareUse)
    or (isnotempty(Tags) and tolower(tostring(Tags)) has_any ("cisa-kev", "cisa exploited", "cisa_exploited"))
| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
| extend
    CisaKnownExploitedAddedDate = iif(isnotempty(CisaKnownExploitedAddedDate), datetime_add('second', toint(todouble(CisaKnownExploitedAddedDate)), datetime(1970-01-01)), datetime(null)),
    CisaKnownExploitedDueDate   = iif(isnotempty(CisaKnownExploitedDueDate),   datetime_add('second', toint(todouble(CisaKnownExploitedDueDate)),   datetime(1970-01-01)), datetime(null))
| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )
| project
    TimeGenerated,
    CveId,
    VulnName,
    RiskRating,
    Priority,
    ExploitationState,
    ExploitationConsequence,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    CisaKnownExploitedAddedDate,
    CisaKnownExploitedDueDate,
    CisaKnownExploitedRansomwareUse,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

YAML

incidentConfiguration:
  groupingConfiguration:
    groupByCustomDetails:
    - CveId
    lookbackDuration: P1D
    enabled: true
    reopenClosedIncident: false
    matchingMethod: Selected
  createIncident: true
name: GTI - CISA Known Exploited Vulnerability Detected
triggerOperator: gt
query: |
  GTIVulnerabilities
  | where isnotempty(CisaKnownExploited)
      or isnotempty(CisaKnownExploitedDueDate)
      or isnotempty(CisaKnownExploitedAddedDate)
      or isnotempty(CisaKnownExploitedRansomwareUse)
      or (isnotempty(Tags) and tolower(tostring(Tags)) has_any ("cisa-kev", "cisa exploited", "cisa_exploited"))
  | extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
  | extend
      CisaKnownExploitedAddedDate = iif(isnotempty(CisaKnownExploitedAddedDate), datetime_add('second', toint(todouble(CisaKnownExploitedAddedDate)), datetime(1970-01-01)), datetime(null)),
      CisaKnownExploitedDueDate   = iif(isnotempty(CisaKnownExploitedDueDate),   datetime_add('second', toint(todouble(CisaKnownExploitedDueDate)),   datetime(1970-01-01)), datetime(null))
  | extend
      Vendor       = tostring(Cpes[0].start_cpe.vendor),
      Product      = tostring(Cpes[0].start_cpe.product),
      CpeVersion   = tostring(Cpes[0].start_cpe.version),
      VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
  | mv-apply _c = Cpes on (
      where isnotnull(_c.start_cpe)
      | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                  AffectedProducts = make_set(tostring(_c.start_cpe.product))
    )
  | project
      TimeGenerated,
      CveId,
      VulnName,
      RiskRating,
      Priority,
      ExploitationState,
      ExploitationConsequence,
      Cvssv3Score,
      Cvssv4xScore,
      EpssScore,
      EpssPercentile,
      CisaKnownExploitedAddedDate,
      CisaKnownExploitedDueDate,
      CisaKnownExploitedRansomwareUse,
      Vendor,
      Product,
      CpeVersion,
      AffectedVendors,
      AffectedProducts,
      Description,
      VendorFixUrl,
      VendorFixReferences,
      Tags,
      Type
queryFrequency: 10m
description: |
  Detects vulnerabilities ingested from Google Threat Intelligence that are in the CISA Known
  Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed active exploitation and
  mandated remediation for federal agencies. Uses the explicit CisaKnownExploited field from the
  GTIVulnerabilities parser, with Tags-based fallback for coverage.
id: 650429cd-afc6-41a5-90e7-6e4a85b2335d
triggerThreshold: 0
queryPeriod: 10m
version: 1.0.0
kind: Scheduled
customDetails:
  CisaAddedDate: CisaKnownExploitedAddedDate
  ExploitState: ExploitationState
  AffectedProduct: Product
  CveId: CveId
  EpssScore: EpssScore
  CisaDueDate: CisaKnownExploitedDueDate
  AffectedVendor: Vendor
  RansomwareUse: CisaKnownExploitedRansomwareUse
  EpssPercentile: EpssPercentile
  Cvssv3Score: Cvssv3Score
  RiskRating: RiskRating
  Priority: Priority
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: High
requiredDataConnectors:
- connectorId: GTIVulnerabilitiesConnector
  dataTypes:
  - GTI_Vulnerabilities_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_CISAKnownExploitedVulnerability.yaml
alertDetailsOverride:
  alertDescriptionFormat: 'CVE: {{CveId}} | Risk: {{RiskRating}} | State: {{ExploitationState}}'
  alertDisplayNameFormat: 'GTI CISA KEV: {{CveId}}'
relevantTechniques:
- T1190
- T1203
tactics:
- InitialAccess
- Execution
- Impact
entityMappings:
- fieldMappings:
  - identifier: Url
    columnName: VendorFixUrl
  entityType: URL

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/650429cd-afc6-41a5-90e7-6e4a85b2335d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/650429cd-afc6-41a5-90e7-6e4a85b2335d')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "CVE: {{CveId}} | Risk: {{RiskRating}} | State: {{ExploitationState}}",
          "alertDisplayNameFormat": "GTI CISA KEV: {{CveId}}"
        },
        "alertRuleTemplateName": "650429cd-afc6-41a5-90e7-6e4a85b2335d",
        "customDetails": {
          "AffectedProduct": "Product",
          "AffectedVendor": "Vendor",
          "CisaAddedDate": "CisaKnownExploitedAddedDate",
          "CisaDueDate": "CisaKnownExploitedDueDate",
          "CveId": "CveId",
          "Cvssv3Score": "Cvssv3Score",
          "EpssPercentile": "EpssPercentile",
          "EpssScore": "EpssScore",
          "ExploitState": "ExploitationState",
          "Priority": "Priority",
          "RansomwareUse": "CisaKnownExploitedRansomwareUse",
          "RiskRating": "RiskRating"
        },
        "description": "Detects vulnerabilities ingested from Google Threat Intelligence that are in the CISA Known\nExploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed active exploitation and\nmandated remediation for federal agencies. Uses the explicit CisaKnownExploited field from the\nGTIVulnerabilities parser, with Tags-based fallback for coverage.\n",
        "displayName": "GTI - CISA Known Exploited Vulnerability Detected",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "VendorFixUrl",
                "identifier": "Url"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": true,
            "groupByCustomDetails": [
              "CveId"
            ],
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google%20Threat%20Intelligence/Analytic%20Rules/Vulnerabilities/GTI_CISAKnownExploitedVulnerability.yaml",
        "query": "GTIVulnerabilities\n| where isnotempty(CisaKnownExploited)\n    or isnotempty(CisaKnownExploitedDueDate)\n    or isnotempty(CisaKnownExploitedAddedDate)\n    or isnotempty(CisaKnownExploitedRansomwareUse)\n    or (isnotempty(Tags) and tolower(tostring(Tags)) has_any (\"cisa-kev\", \"cisa exploited\", \"cisa_exploited\"))\n| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)\n| extend\n    CisaKnownExploitedAddedDate = iif(isnotempty(CisaKnownExploitedAddedDate), datetime_add('second', toint(todouble(CisaKnownExploitedAddedDate)), datetime(1970-01-01)), datetime(null)),\n    CisaKnownExploitedDueDate   = iif(isnotempty(CisaKnownExploitedDueDate),   datetime_add('second', toint(todouble(CisaKnownExploitedDueDate)),   datetime(1970-01-01)), datetime(null))\n| extend\n    Vendor       = tostring(Cpes[0].start_cpe.vendor),\n    Product      = tostring(Cpes[0].start_cpe.product),\n    CpeVersion   = tostring(Cpes[0].start_cpe.version),\n    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))\n| mv-apply _c = Cpes on (\n    where isnotnull(_c.start_cpe)\n    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),\n                AffectedProducts = make_set(tostring(_c.start_cpe.product))\n  )\n| project\n    TimeGenerated,\n    CveId,\n    VulnName,\n    RiskRating,\n    Priority,\n    ExploitationState,\n    ExploitationConsequence,\n    Cvssv3Score,\n    Cvssv4xScore,\n    EpssScore,\n    EpssPercentile,\n    CisaKnownExploitedAddedDate,\n    CisaKnownExploitedDueDate,\n    CisaKnownExploitedRansomwareUse,\n    Vendor,\n    Product,\n    CpeVersion,\n    AffectedVendors,\n    AffectedProducts,\n    Description,\n    VendorFixUrl,\n    VendorFixReferences,\n    Tags,\n    Type\n",
        "queryFrequency": "PT10M",
        "queryPeriod": "PT10M",
        "severity": "High",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Execution",
          "Impact",
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1203"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}