Detection rules › Kusto

Cyren High-Risk IP Indicators

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: high
Time window: 1d
Group by: IP, Source
Source: github.com/Azure/Azure-Sentinel

'Detects high-risk IP indicators (risk score >= 80) from Cyren threat intelligence feeds in the last 24 hours. These IPs are associated with malicious activity such as malware distribution, phishing, or botnet command and control.'

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071` Application Layer Protocol `T1568` Dynamic Resolution

Rule body

id: 5d7e8b3a-1f2c-4e5d-9a0b-c1d2e3f4a5b6
name: Cyren High-Risk IP Indicators
description: |
  'Detects high-risk IP indicators (risk score >= 80) from Cyren threat intelligence feeds in the last 24 hours.
  These IPs are associated with malicious activity such as malware distribution, phishing, or botnet command and control.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CyrenThreatIntel
    dataTypes:
      - Cyren_Indicators_CL
queryFrequency: 1h
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CommandAndControl
  - Impact
relevantTechniques:
  - T1071
  - T1568
query: |
  Cyren_Indicators_CL
  | where TimeGenerated > ago(1d)
  | where isnotempty(ip_s)
  | extend Risk = toint(risk_d)
  | where Risk >= 80
  | summarize 
      DetectionCount = count(), 
      MaxRisk = max(Risk), 
      Categories = make_set(category_s) 
    by IP = ip_s, Source = source_s
  | where DetectionCount >= 1
  | extend 
      IPAddress = IP,
      ThreatCategories = strcat_array(Categories, ", ")
suppressionDuration: 1h
suppressionEnabled: false
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 1d
    matchingMethod: Selected
    groupByEntities:
      - IP
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  RiskScore: MaxRisk
  DetectionCount: DetectionCount
  Categories: ThreatCategories
  Source: Source
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Cyren_Indicators_CL

Stage 2: `where`

| where TimeGenerated > ago(1d)

Stage 3: `where`

| where isnotempty(ip_s)

Stage 4: `extend`

| extend Risk = toint(risk_d)

Stage 5: `where`

| where Risk >= 80

Stage 6: `summarize`

| summarize 
    DetectionCount = count(), 
    MaxRisk = max(Risk), 
    Categories = make_set(category_s) 
  by IP = ip_s, Source = source_s

Stage 7: `where`

| where DetectionCount >= 1

Stage 8: `extend`

| extend 
    IPAddress = IP,
    ThreatCategories = strcat_array(Categories, ", ")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DetectionCount`	ge	`1`	`field:"DetectionCount" kind:ge value:"1"`
`Risk`	ge	`80`	`field:"Risk" kind:ge value:"80"`
`ip_s`	is_not_null	(no value, null check)	`field:"ip_s" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Categories`	`summarize`
`DetectionCount`	`summarize`
`IP`	`summarize`
`MaxRisk`	`summarize`
`Source`	`summarize`
`IPAddress`	`extend`
`ThreatCategories`	`extend`

Cyren High-Risk IP Indicators

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: where

Stage 6: summarize

Stage 7: where

Stage 8: extend