Analytic rule catalog
Cyble Vision Alerts Bitbucket
Back
| Id | f3c25011-4509-41c8-be27-35d891531c39 |
| Rulename | Cyble Vision Alerts Bitbucket |
| Description | Detects exposed secrets in Bitbucket repositories using the Alerts_bit_bucket parser. Creates one incident per matched secret. Includes decoder, detector, commit, file, and repository context for SOC triage. |
| Severity | Low |
| Tactics | CredentialAccess Exfiltration Discovery |
| Techniques | T1552 T1537 T1083 |
| Required data connectors | CybleVisionAlerts |
| Kind | Scheduled |
| Query frequency | 30m |
| Query period | 30m |
| Trigger threshold | 0 |
| Trigger operator | GreaterThan |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_BitBucket.yaml |
| Version | 1.0.0 |
| Arm template | f3c25011-4509-41c8-be27-35d891531c39.json |
Alerts_bit_bucket
| where Service == "bit_bucket"
| extend MappedSeverity = Severity
triggerThreshold: 0
incidentConfiguration:
createIncident: true
groupingConfiguration:
reopenClosedIncident: false
matchingMethod: AllEntities
enabled: false
lookbackDuration: PT5H
kind: Scheduled
description: |
'Detects exposed secrets in Bitbucket repositories using the Alerts_bit_bucket parser. Creates one incident per matched secret. Includes decoder, detector, commit, file, and repository context for SOC triage.'
queryFrequency: 30m
triggerOperator: GreaterThan
relevantTechniques:
- T1552
- T1537
- T1083
entityMappings:
- fieldMappings:
- identifier: Url
columnName: BB_Repository
entityType: Url
- fieldMappings:
- identifier: Url
columnName: BB_Link
entityType: Url
- fieldMappings:
- identifier: Name
columnName: BB_File
- identifier: Directory
columnName: KeywordName
entityType: File
id: f3c25011-4509-41c8-be27-35d891531c39
enabled: true
query: |
Alerts_bit_bucket
| where Service == "bit_bucket"
| extend MappedSeverity = Severity
eventGroupingSettings:
aggregationKind: AlertPerResult
alertDetailsOverride:
alertDisplayNameFormat: Secret Exposure in Bitbucket {{BB_File}} ({{BB_DetectorName}})
alertDescriptionFormat: |
A sensitive secret was detected in Bitbucket repository {{BB_Repository}}. File {{BB_File}}:{{BB_Line}}. Investigator should verify exposure, rotate credentials and remediate impacted systems.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_BitBucket.yaml
version: 1.0.0
requiredDataConnectors:
- dataTypes:
- CybleVisionAlerts_CL
connectorId: CybleVisionAlerts
customDetails:
BB_Email: BB_Email
AlertID: AlertID
BB_Verified: BB_Verified
BB_Repository: BB_Repository
Service: Service
BB_Link: BB_Link
BB_Raw: BB_Raw
MappedSeverity: Severity
BB_DetectorName: BB_DetectorName
BB_Commit: BB_Commit
BB_File: BB_File
BB_Line: BB_Line
BB_RotationGuide: BB_RotationGuide
Status: Status
tactics:
- CredentialAccess
- Exfiltration
- Discovery
queryPeriod: 30m
severity: Low
status: Available
name: Cyble Vision Alerts Bitbucket
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/f3c25011-4509-41c8-be27-35d891531c39')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/f3c25011-4509-41c8-be27-35d891531c39')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "A sensitive secret was detected in Bitbucket repository {{BB_Repository}}. File {{BB_File}}:{{BB_Line}}. Investigator should verify exposure, rotate credentials and remediate impacted systems.\n",
"alertDisplayNameFormat": "Secret Exposure in Bitbucket {{BB_File}} ({{BB_DetectorName}})"
},
"alertRuleTemplateName": "f3c25011-4509-41c8-be27-35d891531c39",
"customDetails": {
"AlertID": "AlertID",
"BB_Commit": "BB_Commit",
"BB_DetectorName": "BB_DetectorName",
"BB_Email": "BB_Email",
"BB_File": "BB_File",
"BB_Line": "BB_Line",
"BB_Link": "BB_Link",
"BB_Raw": "BB_Raw",
"BB_Repository": "BB_Repository",
"BB_RotationGuide": "BB_RotationGuide",
"BB_Verified": "BB_Verified",
"MappedSeverity": "Severity",
"Service": "Service",
"Status": "Status"
},
"description": "'Detects exposed secrets in Bitbucket repositories using the Alerts_bit_bucket parser. Creates one incident per matched secret. Includes decoder, detector, commit, file, and repository context for SOC triage.'\n",
"displayName": "Cyble Vision Alerts Bitbucket",
"enabled": true,
"entityMappings": [
{
"entityType": "Url",
"fieldMappings": [
{
"columnName": "BB_Repository",
"identifier": "Url"
}
]
},
{
"entityType": "Url",
"fieldMappings": [
{
"columnName": "BB_Link",
"identifier": "Url"
}
]
},
{
"entityType": "File",
"fieldMappings": [
{
"columnName": "BB_File",
"identifier": "Name"
},
{
"columnName": "KeywordName",
"identifier": "Directory"
}
]
}
],
"eventGroupingSettings": {
"aggregationKind": "AlertPerResult"
},
"incidentConfiguration": {
"createIncident": true,
"groupingConfiguration": {
"enabled": false,
"lookbackDuration": "PT5H",
"matchingMethod": "AllEntities",
"reopenClosedIncident": false
}
},
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Cyble%20Vision/Analytic%20Rules/Alerts_BitBucket.yaml",
"query": "Alerts_bit_bucket \n| where Service == \"bit_bucket\" \n| extend MappedSeverity = Severity\n",
"queryFrequency": "PT30M",
"queryPeriod": "PT30M",
"severity": "Low",
"status": "Available",
"subTechniques": [],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"CredentialAccess",
"Discovery",
"Exfiltration"
],
"techniques": [
"T1083",
"T1537",
"T1552"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}