CTE - Rule Capacity High (90%)

Severity: medium
Time window: 2d
Source: github.com/Azure/Azure-Sentinel

Tenant-wide blocking-rule/IOC capacity has reached 90%. Emitted by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js) when usage newly crosses this threshold, and re-emitted at most once per ~30 days while it remains above threshold, so this stays a periodic reminder rather than a daily repeat.

Rule body

id: b3eb26f4-affb-4a61-8b54-8780d234008e
name: CTE - Rule Capacity High (90%)
description: |
  Tenant-wide blocking-rule/IOC capacity has reached 90%. Emitted by the daily tenant health-check job (api/src/functions/tenantHealthChecks.js) when usage newly crosses this threshold, and re-emitted at most once per ~30 days while it remains above threshold, so this stays a periodic reminder rather than a daily repeat.
severity: Medium
requiredDataConnectors:
  - connectorId: cybereinforce_cte
    dataTypes:
      - CybereinforceCTE_CL
queryFrequency: 24h
queryPeriod: 2d
triggerOperator: gt
triggerThreshold: 0
tactics:
  []
relevantTechniques: []
query: |
  CybereinforceCTE_CL
  | where EventType == "rule.capacity_high"
  | extend d = parse_json(Details)
  | extend AppName = "Cybereinforce", RuleCount = toint(d.ruleCount), RuleLimit = toint(d.ruleLimit), UsedPct = todouble(d.usedPct)
  | project TimeGenerated, TenantId, AppName, RuleCount, RuleLimit, UsedPct, Severity, Category, Source
entityMappings:
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: AppName
      - identifier: InstanceName
        columnName: TenantId
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

CybereinforceCTE_CL

Stage 2: `where`

| where EventType == "rule.capacity_high"

Stage 3: `extend`

| extend d = parse_json(Details)

Stage 4: `extend`

| extend AppName = "Cybereinforce", RuleCount = toint(d.ruleCount), RuleLimit = toint(d.ruleLimit), UsedPct = todouble(d.usedPct)

Stage 5: `project`

| project TimeGenerated, TenantId, AppName, RuleCount, RuleLimit, UsedPct, Severity, Category, Source

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventType`	eq	`rule.capacity_high`	`field:"EventType" kind:eq value:"rule.capacity_high"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AppName`	`project`
`Category`	`project`
`RuleCount`	`project`
`RuleLimit`	`project`
`Severity`	`project`
`Source`	`project`
`TenantId`	`project`
`TimeGenerated`	`project`
`UsedPct`	`project`

CTE - Rule Capacity High (90%)

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend