Cyren Feed Outage Detection

Cyren_Indicators_CL
| where TimeGenerated >= ago(24h)
| summarize 
    Total = count(), 
    Latest = max(TimeGenerated)
| extend HoursAgo = datetime_diff('hour', now(), Latest)
| where isnotempty(Latest) and HoursAgo >= 6
| project 
    LatestEventTime = Latest, 
    HoursSinceLastEvent = HoursAgo, 
    TotalEventsLast24h = Total,
    AlertMessage = strcat("Cyren feed has not received data for ", HoursAgo, " hours")

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyrenThreatIntelligence/Analytic%20Rules/Cyren%20-%20Feed%20Outage%20Detection.yaml
customDetails:
  HoursSinceLastEvent: HoursSinceLastEvent
  LatestEventTime: LatestEventTime
  TotalEventsLast24h: TotalEventsLast24h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    reopenClosedIncident: false
    enabled: false
    matchingMethod: Selected
    lookbackDuration: 1d
relevantTechniques:
- T1562
suppressionDuration: 1h
triggerOperator: gt
queryPeriod: 1d
severity: Medium
eventGroupingSettings:
  aggregationKind: SingleAlert
query: |
  Cyren_Indicators_CL
  | where TimeGenerated >= ago(24h)
  | summarize 
      Total = count(), 
      Latest = max(TimeGenerated)
  | extend HoursAgo = datetime_diff('hour', now(), Latest)
  | where isnotempty(Latest) and HoursAgo >= 6
  | project 
      LatestEventTime = Latest, 
      HoursSinceLastEvent = HoursAgo, 
      TotalEventsLast24h = Total,
      AlertMessage = strcat("Cyren feed has not received data for ", HoursAgo, " hours")
id: 7f9a0d5c-3b4c-6d7e-1f2a-e3f4a5b6c7d8
triggerThreshold: 0
requiredDataConnectors:
- connectorId: CyrenThreatIntel
  dataTypes:
  - Cyren_Indicators_CL
queryFrequency: 1h
kind: Scheduled
status: Available
version: 1.0.0
description: |
  'Detects when the Cyren threat intelligence feed has not ingested any data for 6 or more hours.
  This may indicate a connectivity issue with the data connector, API authentication problems, or upstream service disruption.'
tactics:
- DefenseEvasion
name: Cyren Feed Outage Detection

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7f9a0d5c-3b4c-6d7e-1f2a-e3f4a5b6c7d8')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7f9a0d5c-3b4c-6d7e-1f2a-e3f4a5b6c7d8')]",
      "properties": {
        "alertRuleTemplateName": "7f9a0d5c-3b4c-6d7e-1f2a-e3f4a5b6c7d8",
        "customDetails": {
          "HoursSinceLastEvent": "HoursSinceLastEvent",
          "LatestEventTime": "LatestEventTime",
          "TotalEventsLast24h": "TotalEventsLast24h"
        },
        "description": "'Detects when the Cyren threat intelligence feed has not ingested any data for 6 or more hours.\nThis may indicate a connectivity issue with the data connector, API authentication problems, or upstream service disruption.'\n",
        "displayName": "Cyren Feed Outage Detection",
        "enabled": true,
        "entityMappings": null,
        "eventGroupingSettings": {
          "aggregationKind": "SingleAlert"
        },
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "P1D",
            "matchingMethod": "Selected",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CyrenThreatIntelligence/Analytic%20Rules/Cyren%20-%20Feed%20Outage%20Detection.yaml",
        "query": "Cyren_Indicators_CL\n| where TimeGenerated >= ago(24h)\n| summarize \n    Total = count(), \n    Latest = max(TimeGenerated)\n| extend HoursAgo = datetime_diff('hour', now(), Latest)\n| where isnotempty(Latest) and HoursAgo >= 6\n| project \n    LatestEventTime = Latest, \n    HoursSinceLastEvent = HoursAgo, \n    TotalEventsLast24h = Total,\n    AlertMessage = strcat(\"Cyren feed has not received data for \", HoursAgo, \" hours\")\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion"
        ],
        "techniques": [
          "T1562"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}