GTI - CISA Known Exploited Vulnerability Detected

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

Detects vulnerabilities ingested from Google Threat Intelligence that are in the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed active exploitation and mandated remediation for federal agencies. Uses the explicit CisaKnownExploited field from the GTIVulnerabilities parser, with Tags-based fallback for coverage.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Execution	`T1203` Exploitation for Client Execution

Rule body

id: 650429cd-afc6-41a5-90e7-6e4a85b2335d
name: GTI - CISA Known Exploited Vulnerability Detected
description: |
  Detects vulnerabilities ingested from Google Threat Intelligence that are in the CISA Known
  Exploited Vulnerabilities (KEV) catalog, meaning CISA has confirmed active exploitation and
  mandated remediation for federal agencies. Uses the explicit CisaKnownExploited field from the
  GTIVulnerabilities parser, with Tags-based fallback for coverage.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: GTIVulnerabilitiesConnector
    dataTypes:
      - GTI_Vulnerabilities_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Execution
  - Impact
relevantTechniques:
  - T1190
  - T1203
query: |
  GTIVulnerabilities
  | where isnotempty(CisaKnownExploited)
      or isnotempty(CisaKnownExploitedDueDate)
      or isnotempty(CisaKnownExploitedAddedDate)
      or isnotempty(CisaKnownExploitedRansomwareUse)
      or (isnotempty(Tags) and tolower(tostring(Tags)) has_any ("cisa-kev", "cisa exploited", "cisa_exploited"))
  | extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
  | extend
      CisaKnownExploitedAddedDate = iif(isnotempty(CisaKnownExploitedAddedDate), datetime_add('second', toint(todouble(CisaKnownExploitedAddedDate)), datetime(1970-01-01)), datetime(null)),
      CisaKnownExploitedDueDate   = iif(isnotempty(CisaKnownExploitedDueDate),   datetime_add('second', toint(todouble(CisaKnownExploitedDueDate)),   datetime(1970-01-01)), datetime(null))
  | extend
      Vendor       = tostring(Cpes[0].start_cpe.vendor),
      Product      = tostring(Cpes[0].start_cpe.product),
      CpeVersion   = tostring(Cpes[0].start_cpe.version),
      VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
  | mv-apply _c = Cpes on (
      where isnotnull(_c.start_cpe)
      | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                  AffectedProducts = make_set(tostring(_c.start_cpe.product))
    )
  | project
      TimeGenerated,
      CveId,
      VulnName,
      RiskRating,
      Priority,
      ExploitationState,
      ExploitationConsequence,
      Cvssv3Score,
      Cvssv4xScore,
      EpssScore,
      EpssPercentile,
      CisaKnownExploitedAddedDate,
      CisaKnownExploitedDueDate,
      CisaKnownExploitedRansomwareUse,
      Vendor,
      Product,
      CpeVersion,
      AffectedVendors,
      AffectedProducts,
      Description,
      VendorFixUrl,
      VendorFixReferences,
      Tags,
      Type
alertDetailsOverride:
  alertDisplayNameFormat: 'GTI CISA KEV: {{CveId}}'
  alertDescriptionFormat: 'CVE: {{CveId}} | Risk: {{RiskRating}} | State: {{ExploitationState}}'
entityMappings:
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: VendorFixUrl
customDetails:
  CveId: CveId
  RiskRating: RiskRating
  Priority: Priority
  ExploitState: ExploitationState
  Cvssv3Score: Cvssv3Score
  EpssScore: EpssScore
  EpssPercentile: EpssPercentile
  CisaAddedDate: CisaKnownExploitedAddedDate
  CisaDueDate: CisaKnownExploitedDueDate
  RansomwareUse: CisaKnownExploitedRansomwareUse
  AffectedVendor: Vendor
  AffectedProduct: Product
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P1D
    matchingMethod: Selected
    groupByCustomDetails:
      - CveId
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GTIVulnerabilities

Stage 2: `where`

| where isnotempty(CisaKnownExploited)
    or isnotempty(CisaKnownExploitedDueDate)
    or isnotempty(CisaKnownExploitedAddedDate)
    or isnotempty(CisaKnownExploitedRansomwareUse)
    or (isnotempty(Tags) and tolower(tostring(Tags)) has_any ("cisa-kev", "cisa exploited", "cisa_exploited"))

Stage 3: `extend` (3 consecutive steps)

| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
| extend
    CisaKnownExploitedAddedDate = iif(isnotempty(CisaKnownExploitedAddedDate), datetime_add('second', toint(todouble(CisaKnownExploitedAddedDate)), datetime(1970-01-01)), datetime(null)),
    CisaKnownExploitedDueDate   = iif(isnotempty(CisaKnownExploitedDueDate),   datetime_add('second', toint(todouble(CisaKnownExploitedDueDate)),   datetime(1970-01-01)), datetime(null))
| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))

Stage 4: `kusto:mv-apply`

| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )

Stage 5: `project`

| project
    TimeGenerated,
    CveId,
    VulnName,
    RiskRating,
    Priority,
    ExploitationState,
    ExploitationConsequence,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    CisaKnownExploitedAddedDate,
    CisaKnownExploitedDueDate,
    CisaKnownExploitedRansomwareUse,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

Stage 6: `summarize` aggregation inside the `mv-apply` branch

summarize

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CisaKnownExploited`	is_not_null	(no value, null check)	`field:"CisaKnownExploited" kind:is_not_null`
`CisaKnownExploitedAddedDate`	is_not_null	(no value, null check)	`field:"CisaKnownExploitedAddedDate" kind:is_not_null`
`CisaKnownExploitedDueDate`	is_not_null	(no value, null check)	`field:"CisaKnownExploitedDueDate" kind:is_not_null`
`CisaKnownExploitedRansomwareUse`	is_not_null	(no value, null check)	`field:"CisaKnownExploitedRansomwareUse" kind:is_not_null`
`Tags`	is_not_null	(no value, null check)	`field:"Tags" kind:is_not_null`
`Tags`	match	`cisa exploited` transforms: `tolower`, `tostring`, `term` `cisa-kev` transforms: `tolower`, `tostring`, `term` `cisa_exploited` transforms: `tolower`, `tostring`, `term`	`field:"Tags" kind:match`
`start_cpe`	is_not_null	(no value, null check)	`field:"start_cpe" kind:is_not_null`

GTI - CISA Known Exploited Vulnerability Detected

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend (3 consecutive steps)

Stage 4: kusto:mv-apply

Stage 5: project