{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/A667D635-D2A7-47E7-8827-8FB243AF2AFD')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/A667D635-D2A7-47E7-8827-8FB243AF2AFD')]",
      "properties": {
        "alertRuleTemplateName": "A667D635-D2A7-47E7-8827-8FB243AF2AFD",
        "customDetails": {
          "AlertID": "AlertID",
          "Asset": "SS_Asset",
          "CertificateTitle": "SS_Title",
          "DaysToExpiry": "SS_DaysUntilExpiry",
          "ExpiryDate": "SS_Expiry",
          "MappedSeverity": "Severity",
          "Port": "SS_Port",
          "Service": "Service",
          "Status": "Status"
        },
        "description": "'Generates Microsoft Sentinel incidents for SSL certificates nearing expiry as detected by Cyble. These alerts help identify certificate hygiene risks that may lead to service disruption or security issues. Severity is normalized using MappedSeverity for downstream automation.'\n",
        "displayName": "Cyble Vision Alerts SSL Certificate Expiry",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "SS_Asset",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SS_Asset",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SS_Port",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "alertDescriptionFormat": "",
          "alertDetailsOverride": null,
          "alertDisplayNameFormat": "SSL Certificate Expiry  {{DC_ServerName}}",
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ssl_expiry.yaml",
        "query": "Alerts_ssl_expiry\n| where Service == \"ssl_expiry\" \n| extend MappedSeverity = Severity\n",
        "queryfrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1499"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}