Detection rules › Kusto

Cyble Vision Alerts Github

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: low
Time window: 30m
Source: github.com/Azure/Azure-Sentinel

'This alert generates incidents for Github'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552` Unsecured Credentials
Collection	`T1213` Data from Information Repositories `T1530` Data from Cloud Storage

Rule body

id: 117e8f7c-8f44-4061-bcc2-b444b98a3838
name: Cyble Vision Alerts Github
description: |
  'This alert generates incidents for Github'
severity: Low
status: Available
requiredDataConnectors:
- connectorId: CybleVisionAlerts
  dataTypes:
  - CybleVisionAlerts_CL
enabled: true
queryFrequency: 30m
queryPeriod: 30m
triggerOperator: GreaterThan
triggerThreshold: 0
suppressionDuration: PT5H
eventGroupingSettings:
  aggregationKind: AlertPerResult
tactics:
- Collection
- CredentialAccess
relevantTechniques:
- T1213
- T1530
- T1552
subTechniques: []
query: |
  Alerts_github
  | where Service contains "github"
  | extend MappedSeverity = Severity
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: false
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: AllEntities
alertDetailsOverride:
  alertDisplayNameFormat: Cyble Vision Alert for Github
  alertDescriptionFormat: This Rule generate incidents for Serviec Github
  alertDynamicProperties: []
customDetails:
  MappedSeverity: Severity
  Status: Status
  AlertID: AlertID
  Service: Service
  GitURl: git_url
  URL: html_url
  Repository: repo_full_name
  FileName: file_name
  Owner: owner_login
  SHA: sha
  Score: score
  OriginalSeverity: Severity
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: owner_login
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: html_url
- entityType: File
  fieldMappings:
  - identifier: Name
    columnName: file_name
  - identifier: Directory
    columnName: file_path
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Alerts_github

Stage 2: `where`

| where Service contains "github"

Stage 3: `extend`

| extend MappedSeverity = Severity

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Service`	contains	`github`	`field:"Service" kind:contains value:"github"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`MappedSeverity`	`extend`