↳ GitHub sourceAnalytics ruleHigh

GTI - Actively Exploited Vulnerability Detected

Description

Detects vulnerabilities ingested from Google Threat Intelligence where the exploitation state is Confirmed or Wide, indicating the vulnerability is being actively exploited in the wild. Fires when such a record is ingested via the GTIVulnerabilities parser, prompting analyst triage and remediation.

Rule type: Scheduled
Version: 1.0.0
Declared status: Available
Query frequency: 10m
Query period: 10m
Trigger: gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

GTIVulnerabilitiesConnector

Data types

GTI_Vulnerabilities_CL

KQL query

Original query, unchanged.

GTIVulnerabilities
| where ExploitationState in ("Confirmed", "Wide")
| extend Cvssv3Score = coalesce(Cvssv3xBaseScore, Cvssv3xTranslatedBaseScore)
| extend
    Vendor       = tostring(Cpes[0].start_cpe.vendor),
    Product      = tostring(Cpes[0].start_cpe.product),
    CpeVersion   = tostring(Cpes[0].start_cpe.version),
    VendorFixUrl = coalesce(tostring(VendorFixReferences[0].url), tostring(VendorFixReferences[0]))
| mv-apply _c = Cpes on (
    where isnotnull(_c.start_cpe)
    | summarize AffectedVendors  = make_set(tostring(_c.start_cpe.vendor)),
                AffectedProducts = make_set(tostring(_c.start_cpe.product))
  )
| project
    TimeGenerated,
    CveId,
    VulnName,
    ExploitationState,
    ExploitationConsequence,
    ExploitReleaseDate,
    FirstExploitation,
    Cvssv3Score,
    Cvssv4xScore,
    EpssScore,
    EpssPercentile,
    Cvssv4xThreatExploitMaturity,
    RiskRating,
    Priority,
    RecentActivityRelativeChange,
    Vendor,
    Product,
    CpeVersion,
    AffectedVendors,
    AffectedProducts,
    Description,
    VendorFixUrl,
    VendorFixReferences,
    Tags,
    Type

Declared entities

URL

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_ActivelyExploitedVulnerability.yaml ↗
Commit: 9800e51 ↗
Source identifier: 4d284d59-1ce5-4ea7-8e97-52256b95aa10

Additional source files 2

Solutions/Google Threat Intelligence/Analytic Rules/Vulnerabilities/GTI_ActivelyExploitedVulnerability.yamlsource ↗Solutions/Google Threat Intelligence/Data/Solution_GoogleThreatIntelligence.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.