CTE - Device License Capacity High (95%)

Severity: medium
Time window: 2d
Source: github.com/Azure/Azure-Sentinel

Device license capacity has reached 95%. Emitted once when usage newly crosses this threshold by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js); resets and can re-fire if usage later drops back below 95% and crosses again.

Rule body

id: 5e644219-6067-4849-85df-7458aa575aea
name: CTE - Device License Capacity High (95%)
description: |
  Device license capacity has reached 95%. Emitted once when usage newly crosses this threshold by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js); resets and can re-fire if usage later drops back below 95% and crosses again.
severity: Medium
requiredDataConnectors:
  - connectorId: cybereinforce_cte
    dataTypes:
      - CybereinforceCTE_CL
queryFrequency: 24h
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
tactics:
  []
relevantTechniques: []
query: |
  CybereinforceCTE_CL
  | where EventType == "license.capacity_high"
  | extend d = parse_json(Details)
  | extend AppName = "Cybereinforce", ActiveDevices = toint(d.activeDevices), LicensedDevices = toint(d.licensedDevices), UsedPct = todouble(d.usedPct)
  | project TimeGenerated, TenantId, AppName, ActiveDevices, LicensedDevices, UsedPct, Severity, Category, Source
entityMappings:
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: AppName
      - identifier: InstanceName
        columnName: TenantId
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CybereinforceCTE_CL

Stage 2: `where`

| where EventType == "license.capacity_high"

Stage 3: `extend`

| extend d = parse_json(Details)

Stage 4: `extend`

| extend AppName = "Cybereinforce", ActiveDevices = toint(d.activeDevices), LicensedDevices = toint(d.licensedDevices), UsedPct = todouble(d.usedPct)

Stage 5: `project`

| project TimeGenerated, TenantId, AppName, ActiveDevices, LicensedDevices, UsedPct, Severity, Category, Source

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	eq	`license.capacity_high`	`field:"EventType" kind:eq value:"license.capacity_high"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActiveDevices`	`project`
`AppName`	`project`
`Category`	`project`
`LicensedDevices`	`project`
`Severity`	`project`
`Source`	`project`
`TenantId`	`project`
`TimeGenerated`	`project`
`UsedPct`	`project`

CTE - Device License Capacity High (95%)

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend