High Number of Urgent Vulnerabilities Detected

Status: available
Severity: medium
Time window: 1h
Group by: IPAddress, NetBios
Source: github.com/Azure/Azure-Sentinel

'This Creates an incident when a host has a high number of Urgent, severity 5, vulnerabilities detected.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

id: 3edb7215-250b-40c0-8b46-79093949242d
name: High Number of Urgent Vulnerabilities Detected
description: |
  'This Creates an incident when a host has a high number of Urgent, severity 5, vulnerabilities detected.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: QualysVMLogsCCPDefinition
    dataTypes:
      - QualysHostDetection
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |
  let threshold = 10;
  QualysHostDetection
  | where Severity == "5"
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by NetBios, IPAddress
  | where count_ >= threshold
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: NetBios
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPAddress
version: 1.0.3
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 10;

Stage 1: `source`

QualysHostDetection

Stage 2: `where`

| where Severity == "5"

Stage 3: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), count() by NetBios, IPAddress

Stage 4: `where`

| where count_ >= threshold

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Severity`	eq	`5`	`field:"Severity" kind:eq value:"5"`
`count_`	ge	`10`	`field:"count_" kind:ge value:"10"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`EndTime`	`summarize`
`IPAddress`	`summarize`
`NetBios`	`summarize`
`StartTime`	`summarize`