Cyble Vision Alerts IOCS

Back


Id	c8cf42d5-8684-435f-9c4d-9dd0cc47eaec
Rulename	Cyble Vision Alerts IOC’S
Description	Detects malicious Indicators of Compromise such as IPs, domains, URLs, and hashes. Extracts IOC type, behaviour tags, risk rating, and timestamps using Alerts_IOCs parser. Triggers an incident with mapped entities, severity, and details.
Severity	Low
Tactics	Reconnaissance InitialAccess Discovery CommandAndControl Impact
Techniques	T1595 T1133 T1046 T1071 T1486
Required data connectors	CybleVisionAlerts
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	GreaterThan
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_IOC’S.yaml
Version	1.0.0
Arm template	c8cf42d5-8684-435f-9c4d-9dd0cc47eaec.json

KQL

Alerts_iocs 
| where Service == "iocs" 
| extend MappedSeverity = Severity

YAML

relevantTechniques:
- T1595
- T1133
- T1046
- T1071
- T1486
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IOC_Value
    identifier: Address
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
query: |
  Alerts_iocs 
  | where Service == "iocs" 
  | extend MappedSeverity = Severity  
id: c8cf42d5-8684-435f-9c4d-9dd0cc47eaec
suppressionDuration: PT5H
severity: Low
kind: Scheduled
queryFrequency: 30m
description: |
    'Detects malicious Indicators of Compromise such as IPs, domains, URLs, and hashes. Extracts IOC type, behaviour tags, risk rating, and timestamps using Alerts_IOCs parser. Triggers an incident with mapped entities, severity, and details.'
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
subTechniques: []
triggerOperator: GreaterThan
name: Cyble Vision Alerts IOC'S
tactics:
- Reconnaissance
- InitialAccess
- Discovery
- CommandAndControl
- Impact
alertDetailsOverride:
  alertDescriptionFormat: |
        Type {{IOC_Type}} Behaviour {{IOC_BehaviourTags}} Risk Rating {{IOC_RiskRating}}'
  alertDynamicProperties: []
  alertDisplayNameFormat: CybleVision IOC Detected {{IOC_Value}}
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_IOC'S.yaml
triggerThreshold: 0
queryPeriod: 30m
enabled: true
status: Available
customDetails:
  IOCAttackName: IOC_AttackName
  IOCType: IOC_Type
  Status: Status
  IOC: IOC_Value
  LastSeen: IOC_LastSeen
  IOCConfidentRating: IOC_ConfidentRating
  FirstSeen: IOC_FirstSeen
  Reference: IOC_ReferenceLink
  UUID: IOC_UUID
  IOCRiskRating: IOC_RiskRating
  Tags: IOC_Tags
  Service: Service
  AlertID: AlertID
  MappedSeverity: Severity
  IOCBehaviour: IOC_BehaviourTags
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    lookbackDuration: PT5H
    enabled: false
    reopenClosedIncident: false
    matchingMethod: AllEntities

ARM