Detection rules › Kusto

XbowCriticalHighFindings

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: high
Time window: 1h
Group by: AssetId, FindingId
Source: github.com/Azure/Azure-Sentinel

Creates an incident for each Critical or High severity finding reported by XBOW that is currently in an open state. These findings represent the most severe security issues and require immediate attention. Each alert is deduplicated per finding so re-ingestion of the same finding does not produce duplicate incidents.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

id: f8e7d6c5-4b3a-4912-8f0e-2d1c3b4a5678
name: XbowCriticalHighFindings
description: |
  Creates an incident for each Critical or High severity finding reported by XBOW that
  is currently in an open state. These findings represent the most severe security issues
  and require immediate attention. Each alert is deduplicated per finding so re-ingestion
  of the same finding does not produce duplicate incidents.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: XbowSecurityConnector
    dataTypes:
      - XbowFindings_CL
      - XbowAssets_CL
queryFrequency: 30m
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - PrivilegeEscalation
  - DefenseEvasion
  - Impact
relevantTechniques:
  - T1190
query: |
  XbowFindings_CL
  | where TimeGenerated > ago(1h)
  | where tolower(Severity) in ('critical', 'high')
  | where isempty(State) or tolower(State) == 'open'
  | summarize arg_max(TimeGenerated, *) by FindingId
  | join kind=leftouter (
      XbowAssets_CL
      | summarize arg_max(TimeGenerated, *) by AssetId
      | project AssetId, StartUrl
  ) on AssetId
  | project
      TimeGenerated,
      FindingId,
      FindingName,
      Severity,
      State,
      Summary,
      Impact,
      Mitigations,
      Recipe,
      AssetId,
      AssetName,
      OrganizationId,
      CreatedAt,
      StartUrl
eventGroupingSettings:
  aggregationKind: AlertPerResult
alertDetailsOverride:
  alertDisplayNameFormat: 'XBOW {{Severity}}: {{FindingName}}'
  alertDescriptionFormat: '{{Severity}} severity finding on {{AssetName}}. {{Summary}}'
customDetails:
  FindingID: FindingId
  FindingName: FindingName
  Severity: Severity
  State: State
  AssetID: AssetId
  AssetName: AssetName
  OrganizationID: OrganizationId
  CreatedAt: CreatedAt
  Mitigations: Mitigations
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: 24h
    matchingMethod: Selected
    groupByCustomDetails:
      - FindingID
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: StartUrl
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

XbowFindings_CL

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `where`

| where tolower(Severity) in ('critical', 'high')

Stage 4: `where`

| where isempty(State) or tolower(State) == 'open'

Stage 5: `summarize`

| summarize arg_max(TimeGenerated, *) by FindingId

Stage 6: `join`

| join kind=leftouter (
    XbowAssets_CL
    | summarize arg_max(TimeGenerated, *) by AssetId
    | project AssetId, StartUrl
) on AssetId

Stage 7: `project`

| project
    TimeGenerated,
    FindingId,
    FindingName,
    Severity,
    State,
    Summary,
    Impact,
    Mitigations,
    Recipe,
    AssetId,
    AssetName,
    OrganizationId,
    CreatedAt,
    StartUrl

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Severity`	in	`critical` transforms: `tolower` `high` transforms: `tolower`	`field:"Severity" kind:in`
`State`	eq	`open` transforms: `tolower`	`field:"State" kind:eq value:"open"`
`State`	is_null	(no value, null check)	`field:"State" kind:is_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AssetId`	`project`
`AssetName`	`project`
`CreatedAt`	`project`
`FindingId`	`project`
`FindingName`	`project`
`Impact`	`project`
`Mitigations`	`project`
`OrganizationId`	`project`
`Recipe`	`project`
`Severity`	`project`
`StartUrl`	`project`
`State`	`project`
`Summary`	`project`
`TimeGenerated`	`project`

XbowCriticalHighFindings

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: summarize

Stage 6: join

Stage 7: project