Alerts_news_feed
| where Service == "news_feed"
| extend MappedSeverity = Severity
customDetails:
Service: Service
NF_PostSource: NF_PostSourceName
Status: Status
NF_PostTitle: NF_PostTitle
MappedSeverity: Severity
NF_AI_Summary: NF_AI_Summary
NF_PostURL: NF_PostURL
AlertID: AlertID
triggerOperator: GreaterThan
tactics:
- Reconnaissance
incidentConfiguration:
alertDescriptionFormat: |
A news article referencing the monitored keyword {{KeywordName}} was identified. Source {{NF_PostSourceName}}. URL {{NF_PostURL}}.
alertDisplayNameFormat: Relevant Cybersecurity News {{NF_PostTitle}}
alertDetailsOverride:
groupingConfiguration:
reopenClosedIncident: false
matchingMethod: AllEntities
lookbackDuration: PT5H
enabled: false
createIncident: true
enabled: true
eventGroupingSettings:
aggregationKind: AlertPerResult
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble Vision/Analytic Rules/Alerts_News_Feed.yaml
version: 1.0.0
query: |
Alerts_news_feed
| where Service == "news_feed"
| extend MappedSeverity = Severity
triggerThreshold: 0
relevantTechniques:
- T1598
queryPeriod: 30m
status: Available
severity: Low
kind: Scheduled
name: Cyble Vision Alerts News Feed Alert
queryfrequency: 30m
id: d205a93f-b2e3-4708-a359-5e0c88ee3e59
description: |
'Triggers when monitored keywords are found in external news feeds. Helps analysts track relevant cybersecurity news, advisories, or threat intelligence updates tied to monitored entities.'
requiredDataConnectors:
- dataTypes:
- CybleVisionAlerts_CL
connectorId: CybleVisionAlerts
entityMappings:
- fieldMappings:
- columnName: NF_PostURL
identifier: Url
entityType: Url
- fieldMappings:
- columnName: KeywordName
identifier: HostName
entityType: Host
