CTE - License Expiring Soon (30 Days)

Severity: medium
Time window: 2d
Source: github.com/Azure/Azure-Sentinel

A paid Cybereinforce license is expiring within 30 days - a reminder to plan renewal before it lapses. Emitted once per license term by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js); re-arms automatically on renewal. Trial licenses do not get this 30-day reminder, only the 7-day critical one below.

Rule body

id: ec305a18-2520-443d-9f54-18dea3637a15
name: CTE - License Expiring Soon (30 Days)
description: |
  A paid Cybereinforce license is expiring within 30 days - a reminder to plan renewal before it lapses. Emitted once per license term by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js); re-arms automatically on renewal. Trial licenses do not get this 30-day reminder, only the 7-day critical one below.
severity: Medium
requiredDataConnectors:
  - connectorId: cybereinforce_cte
    dataTypes:
      - CybereinforceCTE_CL
queryFrequency: 24h
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
tactics:
  []
relevantTechniques: []
query: |
  CybereinforceCTE_CL
  | where EventType == "license.expiring_soon"
  | extend d = parse_json(Details)
  | extend DaysRemaining = toint(d.daysRemaining), EndAt = tostring(d.endAt), Plan = tostring(d.plan), AppName = "Cybereinforce"
  | project TimeGenerated, TenantId, DaysRemaining, EndAt, Plan, AppName, Severity, Category, Source
entityMappings:
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: AppName
      - identifier: InstanceName
        columnName: TenantId
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CybereinforceCTE_CL

Stage 2: `where`

| where EventType == "license.expiring_soon"

Stage 3: `extend`

| extend d = parse_json(Details)

Stage 4: `extend`

| extend DaysRemaining = toint(d.daysRemaining), EndAt = tostring(d.endAt), Plan = tostring(d.plan), AppName = "Cybereinforce"

Stage 5: `project`

| project TimeGenerated, TenantId, DaysRemaining, EndAt, Plan, AppName, Severity, Category, Source

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	eq	`license.expiring_soon`	`field:"EventType" kind:eq value:"license.expiring_soon"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AppName`	`project`
`Category`	`project`
`DaysRemaining`	`project`
`EndAt`	`project`
`Plan`	`project`
`Severity`	`project`
`Source`	`project`
`TenantId`	`project`
`TimeGenerated`	`project`

CTE - License Expiring Soon (30 Days)

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend