CyberBlindSpot - Any Issue Detected

Status: available
Severity: informational
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

Generic alert that triggers when ANY CyberBlindSpot issue/incident is detected in the logs. Extracts nested metadata from RawPayload.

MITRE ATT&CK coverage

Tactic	Techniques
Reconnaissance	`T1592` Gather Victim Host Information `T1598` Phishing for Information
Initial Access	`T1566` Phishing

Rule body

id: abe1a662-d00d-482e-aa68-9394622ae02e
name: CyberBlindSpot - Any Issue Detected
description: Generic alert that triggers when ANY CyberBlindSpot issue/incident is detected in the logs. Extracts nested metadata from RawPayload.
severity: Informational
status: Available
requiredDataConnectors:
  - connectorId: CTM360CBSConnectorDefinition
    dataTypes:
      - CBS_MalwareLogs_AzureV2_CL
      - CBS_BreachedCredentials_AzureV2_CL
      - CBS_CompromisedCards_AzureV2_CL
      - CBS_DomainInfringement_AzureV2_CL
      - CBS_SubdomainInfringement_AzureV2_CL
      - CBSLog_AzureV2_CL
tactics:
  - Reconnaissance
  - Discovery
  - ResourceDevelopment
  - InitialAccess
relevantTechniques:
  - T1592
  - T1598
  - T1566
query: |
  CBSLog
  | project TimeGenerated, IncidentId, Subject, Severity, IncidentType, Status, Class, ExternalLink, Brand, FirstSeen, LastSeen, Remarks
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  Subject: Subject
  IncidentType: IncidentType
  Brand: Brand
alertDetailsOverride:
  alertDisplayNameFormat: CyberBlindSpot Alert - {{IncidentType}} on {{Subject}} - {{Brand}}
  alertDescriptionFormat: Type {{IncidentType}} | Subject {{Subject}} | Severity {{Severity}} 
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: Subject
kind: Scheduled
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: GreaterThan
triggerThreshold: 0
suppressionDuration: PT5H
suppressionEnabled: false
version: 1.0.0

Stages and Predicates

Stage 1: `source`

CBSLog

Stage 2: `project`

| project TimeGenerated, IncidentId, Subject, Severity, IncidentType, Status, Class, ExternalLink, Brand, FirstSeen, LastSeen, Remarks

Output fields

These fields are emitted when the rule matches.

Field	Source
`Brand`	`project`
`Class`	`project`
`ExternalLink`	`project`
`FirstSeen`	`project`
`IncidentId`	`project`
`IncidentType`	`project`
`LastSeen`	`project`
`Remarks`	`project`
`Severity`	`project`
`Status`	`project`
`Subject`	`project`
`TimeGenerated`	`project`

CyberBlindSpot - Any Issue Detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: project

Output fields

Stage 1: `source`

Stage 2: `project`