Cyble Vision Alerts SSL Certificate Expiry

Alerts_ssl_expiry
| where Service == "ssl_expiry" 
| extend MappedSeverity = Severity

entityMappings:
- entityType: DNS
  fieldMappings:
  - identifier: DomainName
    columnName: SS_Asset
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: SS_Asset
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: SS_Port
name: Cyble Vision Alerts SSL Certificate Expiry
kind: Scheduled
queryfrequency: 30m
triggerOperator: GreaterThan
status: Available
customDetails:
  Asset: SS_Asset
  ExpiryDate: SS_Expiry
  AlertID: AlertID
  Service: Service
  DaysToExpiry: SS_DaysUntilExpiry
  CertificateTitle: SS_Title
  Status: Status
  Port: SS_Port
  MappedSeverity: Severity
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
queryPeriod: 30m
enabled: true
tactics:
- InitialAccess
- Impact
description: |
  'Generates Microsoft Sentinel incidents for SSL certificates nearing expiry as detected by Cyble. These alerts help identify certificate hygiene risks that may lead to service disruption or security issues. Severity is normalized using MappedSeverity for downstream automation.'
severity: Low
incidentConfiguration:
  alertDisplayNameFormat: SSL Certificate Expiry  {{DC_ServerName}}
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities
  alertDescriptionFormat: ""
  createIncident: true
  alertDetailsOverride: 
id: A667D635-D2A7-47E7-8827-8FB243AF2AFD
eventGroupingSettings:
  aggregationKind: AlertPerResult
triggerThreshold: 0
query: |
  Alerts_ssl_expiry
  | where Service == "ssl_expiry" 
  | extend MappedSeverity = Severity
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ssl_expiry.yaml
version: 1.0.0
relevantTechniques:
- T1190
- T1499

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/A667D635-D2A7-47E7-8827-8FB243AF2AFD')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/A667D635-D2A7-47E7-8827-8FB243AF2AFD')]",
      "properties": {
        "alertRuleTemplateName": "A667D635-D2A7-47E7-8827-8FB243AF2AFD",
        "customDetails": {
          "AlertID": "AlertID",
          "Asset": "SS_Asset",
          "CertificateTitle": "SS_Title",
          "DaysToExpiry": "SS_DaysUntilExpiry",
          "ExpiryDate": "SS_Expiry",
          "MappedSeverity": "Severity",
          "Port": "SS_Port",
          "Service": "Service",
          "Status": "Status"
        },
        "description": "'Generates Microsoft Sentinel incidents for SSL certificates nearing expiry as detected by Cyble. These alerts help identify certificate hygiene risks that may lead to service disruption or security issues. Severity is normalized using MappedSeverity for downstream automation.'\n",
        "displayName": "Cyble Vision Alerts SSL Certificate Expiry",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "DNS",
            "fieldMappings": [
              {
                "columnName": "SS_Asset",
                "identifier": "DomainName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SS_Asset",
                "identifier": "HostName"
              }
            ]
          },
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "SS_Port",
                "identifier": "HostName"
              }
            ]
          }
        ],
        "eventGroupingSettings": {
          "aggregationKind": "AlertPerResult"
        },
        "incidentConfiguration": {
          "alertDescriptionFormat": "",
          "alertDetailsOverride": null,
          "alertDisplayNameFormat": "SSL Certificate Expiry  {{DC_ServerName}}",
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "lookbackDuration": "PT5H",
            "matchingMethod": "AllEntities",
            "reopenClosedIncident": false
          }
        },
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_ssl_expiry.yaml",
        "query": "Alerts_ssl_expiry\n| where Service == \"ssl_expiry\" \n| extend MappedSeverity = Severity\n",
        "queryfrequency": "PT30M",
        "queryPeriod": "PT30M",
        "severity": "Low",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Impact",
          "InitialAccess"
        ],
        "techniques": [
          "T1190",
          "T1499"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}