Cyble Vision Alerts SSL Certificate Expiry

Alerts_ssl_expiry
| where Service == "ssl_expiry" 
| extend MappedSeverity = Severity

entityMappings:
- fieldMappings:
  - identifier: DomainName
    columnName: SS_Asset
  entityType: DNS
- fieldMappings:
  - identifier: HostName
    columnName: SS_Asset
  entityType: Host
- fieldMappings:
  - identifier: HostName
    columnName: SS_Port
  entityType: Host
id: A667D635-D2A7-47E7-8827-8FB243AF2AFD
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ssl_expiry.yaml
triggerOperator: GreaterThan
tactics:
- InitialAccess
- Impact
enabled: true
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - CybleVisionAlerts_CL
  connectorId: CybleVisionAlerts
queryPeriod: 30m
eventGroupingSettings:
  aggregationKind: AlertPerResult
severity: Low
relevantTechniques:
- T1190
- T1499
triggerThreshold: 0
version: 1.0.0
customDetails:
  ExpiryDate: SS_Expiry
  MappedSeverity: Severity
  Port: SS_Port
  AlertID: AlertID
  CertificateTitle: SS_Title
  Asset: SS_Asset
  DaysToExpiry: SS_DaysUntilExpiry
  Service: Service
  Status: Status
name: Cyble Vision Alerts SSL Certificate Expiry
status: Available
query: |
  Alerts_ssl_expiry
  | where Service == "ssl_expiry" 
  | extend MappedSeverity = Severity
description: |
  'Generates Microsoft Sentinel incidents for SSL certificates nearing expiry as detected by Cyble. These alerts help identify certificate hygiene risks that may lead to service disruption or security issues. Severity is normalized using MappedSeverity for downstream automation.'
queryfrequency: 30m
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    lookbackDuration: PT5H
    reopenClosedIncident: false
    matchingMethod: AllEntities
  alertDescriptionFormat: ""
  alertDisplayNameFormat: SSL Certificate Expiry  {{DC_ServerName}}
  alertDetailsOverride: 

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/A667D635-D2A7-47E7-8827-8FB243AF2AFD')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/A667D635-D2A7-47E7-8827-8FB243AF2AFD')]",
      "properties": {
        "alertRuleTemplateName": "A667D635-D2A7-47E7-8827-8FB243AF2AFD",
        "customDetails": {
          "AlertID": "AlertID",
          "Asset": "SS_Asset",
          "CertificateTitle": "SS_Title",
          "DaysToExpiry": "SS_DaysUntilExpiry",
          "ExpiryDate": "SS_Expiry",
          "MappedSeverity": "Severity",
          "Port": "SS_Port",
          "Service": "Service",
          "Status": "Status"
        },
        "description": "'Generates Microsoft Sentinel incidents for SSL certificates nearing expiry as detected by Cyble. These alerts help identify certificate hygiene risks that may lead to service disruption or security issues. Severity is normalized using MappedSeverity for downstream automation.'\n",
        "displayName": "Cyble Vision Alerts SSL Certificate Expiry",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "SS_Asset",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SS_Asset",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SS_Port",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "alertDescriptionFormat": "",
          "alertDetailsOverride": null,
          "alertDisplayNameFormat": "SSL Certificate Expiry  {{DC_ServerName}}",
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ssl_expiry.yaml",
        "query": "Alerts_ssl_expiry\n| where Service == \"ssl_expiry\" \n| extend MappedSeverity = Severity\n",
        "queryfrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1499"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}