Cyble Vision Alerts SSL Certificate Expiry

Alerts_ssl_expiry
| where Service == "ssl_expiry" 
| extend MappedSeverity = Severity

incidentConfiguration:
  alertDetailsOverride: 
  alertDescriptionFormat: ""
  alertDisplayNameFormat: SSL Certificate Expiry  {{DC_ServerName}}
  createIncident: true
  groupingConfiguration:
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: false
name: Cyble Vision Alerts SSL Certificate Expiry
triggerOperator: GreaterThan
query: |
  Alerts_ssl_expiry
  | where Service == "ssl_expiry" 
  | extend MappedSeverity = Severity
queryfrequency: 30m
description: |
  'Generates Microsoft Sentinel incidents for SSL certificates nearing expiry as detected by Cyble. These alerts help identify certificate hygiene risks that may lead to service disruption or security issues. Severity is normalized using MappedSeverity for downstream automation.'
id: A667D635-D2A7-47E7-8827-8FB243AF2AFD
triggerThreshold: 0
queryPeriod: 30m
enabled: true
version: 1.0.0
kind: Scheduled
customDetails:
  Port: SS_Port
  Asset: SS_Asset
  CertificateTitle: SS_Title
  AlertID: AlertID
  DaysToExpiry: SS_DaysUntilExpiry
  ExpiryDate: SS_Expiry
  MappedSeverity: Severity
  Status: Status
  Service: Service
status: Available
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: Low
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ssl_expiry.yaml
relevantTechniques:
- T1190
- T1499
tactics:
- InitialAccess
- Impact
entityMappings:
- fieldMappings:
  - identifier: DomainName
    columnName: SS_Asset
  entityType: DNS
- fieldMappings:
  - identifier: HostName
    columnName: SS_Asset
  entityType: Host
- fieldMappings:
  - identifier: HostName
    columnName: SS_Port
  entityType: Host

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/A667D635-D2A7-47E7-8827-8FB243AF2AFD')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/A667D635-D2A7-47E7-8827-8FB243AF2AFD')]",
      "properties": {
        "alertRuleTemplateName": "A667D635-D2A7-47E7-8827-8FB243AF2AFD",
        "customDetails": {
          "AlertID": "AlertID",
          "Asset": "SS_Asset",
          "CertificateTitle": "SS_Title",
          "DaysToExpiry": "SS_DaysUntilExpiry",
          "ExpiryDate": "SS_Expiry",
          "MappedSeverity": "Severity",
          "Port": "SS_Port",
          "Service": "Service",
          "Status": "Status"
        },
        "description": "'Generates Microsoft Sentinel incidents for SSL certificates nearing expiry as detected by Cyble. These alerts help identify certificate hygiene risks that may lead to service disruption or security issues. Severity is normalized using MappedSeverity for downstream automation.'\n",
        "displayName": "Cyble Vision Alerts SSL Certificate Expiry",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "SS_Asset",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SS_Asset",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SS_Port",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "alertDescriptionFormat": "",
          "alertDetailsOverride": null,
          "alertDisplayNameFormat": "SSL Certificate Expiry  {{DC_ServerName}}",
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ssl_expiry.yaml",
        "query": "Alerts_ssl_expiry\n| where Service == \"ssl_expiry\" \n| extend MappedSeverity = Severity\n",
        "queryfrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1499"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}