↳ GitHub sourceAnalytics ruleHigh

GTI - Critical CVSS Score Vulnerability Detected

Description

Detects vulnerabilities ingested from Google Threat Intelligence with a CVSS v3 base score at or above the critical threshold (9.0). Uses explicit Cvssv3xBaseScore and Cvssv3xTranslatedBaseScore fields from the GTIVulnerabilities parser. Fires when a matching record is found, indicating a critically rated vulnerability that warrants immediate analyst review.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 10m
Query period: 10m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

GTIVulnerabilitiesConnector

Data types

GTI_Vulnerabilities_CL

KQL query

Original query, unchanged.

GTIVulnerabilities
| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
| where isnotempty(Cvssv3Score) and Cvssv3Score >= 9.0
| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )
| project
    TimeGenerated,
    CveId,
    VulnName,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    RiskRating,
    Priority,
    ExploitationState,
    ExploitationConsequence,
    Cvssv4xThreatExploitMaturity,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

Declared entities

URL

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_CriticalCVSSVulnerability.yaml ↗
Commit: 9800e51 ↗
Source identifier: 3794141b-9bd3-41ae-8303-79f97692998b

Additional source files 2

Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_CriticalCVSSVulnerability.yamlsource ↗Solutions/Google Threat Intelligence/Data/Solution_GoogleThreatIntelligence.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.