Detection rules › Kusto
Flare google dork results
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
'This query searches for Google dork search results that indicate publicly accessible information about your organization.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance |
Rule body
id: 9cb7c337-f174-4af6-b0e8-b6b7552d762d
name: Flare google dork results
description: |
'This query searches for Google dork search results that indicate publicly accessible information about your organization.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Flare
dataTypes:
- FireworkV2_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- Reconnaissance
relevantTechniques:
- T1593
query: |
FireworkV2_CL
| where notempty(uid) and RiskScore >= 3
| extend index_name = split(uid, "/")[0]
| extend category_name = split(uid, "/")[1]
| where (index_name == "driller_google") or (index_name == "driller" and category_name contains "google")
version: 3.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
FireworkV2_CL
Stage 2: where
| where notempty(uid) and RiskScore >= 3
Stage 3: extend
| extend index_name = split(uid, "/")[0]
Stage 4: extend
| extend category_name = split(uid, "/")[1]
Stage 5: where
| where (index_name == "driller_google") or (index_name == "driller" and category_name contains "google")
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
RiskScore | ge |
| field:"RiskScore" kind:ge value:"3" |
category_name | contains |
| field:"category_name" kind:contains value:"google" |
index_name | eq |
| field:"index_name" kind:eq |
uid | is_not_null | field:"uid" kind:is_not_null |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
index_name | extend |
category_name | extend |